Edit tour

Windows Analysis Report
2qsdqACnX3.exe

Overview

General Information

Sample name:	2qsdqACnX3.exe renamed because original name is a hash value
Original sample name:	73339cacdb37937c47ea7668ac3a1017.exe
Analysis ID:	1523193
MD5:	73339cacdb37937c47ea7668ac3a1017
SHA1:	b32d273a752ad25173e26a110ae05acbabf3f15d
SHA256:	d0abb0bd329f13afadfb0bbf6730f2233488b8c6c6f5e593d61d91b20fe8b772
Tags:	exePonyuser-abuse_ch
Infos:

Detection

Pony

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Pony

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops / launches Pony Loader self-deletion script - malware possibly based on Pony Loader leaked source code

Machine Learning detection for sample

Pony trojan / infostealer detected

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

2qsdqACnX3.exe (PID: 6632 cmdline: "C:\Users\user\Desktop\2qsdqACnX3.exe" MD5: 73339CACDB37937C47EA7668AC3A1017)

cmd.exe (PID: 940 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\5990015.bat" "C:\Users\user\Desktop\2qsdqACnX3.exe" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
EvilPony, Ponyshe	Privately modded version of the Pony stealer.	No Attribution	https://threatpost.com/docusign-phishing-campaign-includes-hancitor-downloader/125724/	https://malpedia.caad.fkie.fraunhofer.de/details/win.evilpony

Malware Configuration

Threatname: Pony

{"C2 list": ["http://gunnylaumienphi2017.com/"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
2qsdqACnX3.exe	JoeSecurity_Pony	Yara detected Pony	Joe Security
2qsdqACnX3.exe	Windows_Trojan_Pony_d5516fe8	unknown	unknown	0x12518:$a1: \Global Downloader 0x11ca1:$a2: wiseftpsrvs.bin 0x12378:$a3: SiteServer %d\SFTP 0x1236c:$a4: %s\Keychain 0x125d6:$a5: Connections.txt 0x1291d:$a6: ftpshell.fsi 0x13078:$a7: inetcomm server passwords
2qsdqACnX3.exe	pony	Identify Pony	Brian Wallace @botnet_hunter	0x10eb9:$s1: {%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X} 0x130bf:$s1: {%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X} 0x10777:$s2: YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0 0x10d98:$s3: POST %s HTTP/1.0 0x10dc1:$s4: Accept-Encoding: identity, *;q=0
2qsdqACnX3.exe	Fareit	Fareit Payload	kevoreilly	0x132f9:$string1: 0D 0A 09 09 0D 0A 0D 0A 09 20 20 20 3A 6B 74 6B 20 20 20 0D 0A 0D 0A 0D 0A 20 20 20 20 20 64 65 6C 20 20 20 20 09 20 25 31 20 20 0D 0A 09 69 66 20 20 09 09 20 65 78 69 73 74 20 09 20 20 20 25 ...

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.2008897794.0000000000411000.00000008.00000001.01000000.00000003.sdmp	JoeSecurity_Pony	Yara detected Pony	Joe Security
00000000.00000000.2008897794.0000000000411000.00000008.00000001.01000000.00000003.sdmp	Windows_Trojan_Pony_d5516fe8	unknown	unknown	0x2518:$a1: \Global Downloader 0x1ca1:$a2: wiseftpsrvs.bin 0x2378:$a3: SiteServer %d\SFTP 0x236c:$a4: %s\Keychain 0x25d6:$a5: Connections.txt 0x291d:$a6: ftpshell.fsi 0x3078:$a7: inetcomm server passwords
00000000.00000000.2008897794.0000000000411000.00000008.00000001.01000000.00000003.sdmp	pony	Identify Pony	Brian Wallace @botnet_hunter	0xeb9:$s1: {%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X} 0x30bf:$s1: {%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X} 0x777:$s2: YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0 0xd98:$s3: POST %s HTTP/1.0 0xdc1:$s4: Accept-Encoding: identity, *;q=0
00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Pony	Yara detected Pony	Joe Security
00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmp	Windows_Trojan_Pony_d5516fe8	unknown	unknown	0x2518:$a1: \Global Downloader 0x1ca1:$a2: wiseftpsrvs.bin 0x2378:$a3: SiteServer %d\SFTP 0x236c:$a4: %s\Keychain 0x25d6:$a5: Connections.txt 0x291d:$a6: ftpshell.fsi 0x3078:$a7: inetcomm server passwords
00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmp	pony	Identify Pony	Brian Wallace @botnet_hunter	0xeb9:$s1: {%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X} 0x30bf:$s1: {%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X} 0x777:$s2: YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0 0xd98:$s3: POST %s HTTP/1.0 0xdc1:$s4: Accept-Encoding: identity, *;q=0
Process Memory Space: 2qsdqACnX3.exe PID: 6632	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 2qsdqACnX3.exe PID: 6632	JoeSecurity_Pony	Yara detected Pony	Joe Security
Process Memory Space: 2qsdqACnX3.exe PID: 6632	Windows_Trojan_Pony_d5516fe8	unknown	unknown	0x3d91:$a1: \Global Downloader 0x134b0:$a1: \Global Downloader 0x31b8:$a2: wiseftpsrvs.bin 0x12930:$a2: wiseftpsrvs.bin 0x3c4c:$a3: SiteServer %d\SFTP 0x1336b:$a3: SiteServer %d\SFTP 0x3c40:$a4: %s\Keychain 0x1335f:$a4: %s\Keychain 0x3e45:$a5: Connections.txt 0x13564:$a5: Connections.txt 0x452f:$a6: ftpshell.fsi 0x13cc9:$a6: ftpshell.fsi 0x4c3f:$a7: inetcomm server passwords 0x143d9:$a7: inetcomm server passwords
Process Memory Space: 2qsdqACnX3.exe PID: 6632	pony	Identify Pony	Brian Wallace @botnet_hunter	0x173c:$s1: {%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X} 0x24af:$s1: {%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X} 0x5534:$s1: {%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X} 0x10eb4:$s1: {%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X} 0x11c27:$s1: {%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X} 0x14cce:$s1: {%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X} 0x770:$s2: YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0 0xe0b:$s2: YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0 0xfefb:$s2: YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0 0x10596:$s2: YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0 0x1632:$s3: POST %s HTTP/1.0 0x246d:$s3: POST %s HTTP/1.0 0x10daa:$s3: POST %s HTTP/1.0 0x11be5:$s3: POST %s HTTP/1.0 0x165b:$s4: Accept-Encoding: identity, ;q=0 0x10dd3:$s4: Accept-Encoding: identity, ;q=0
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.2qsdqACnX3.exe.400000.0.unpack	JoeSecurity_Pony	Yara detected Pony	Joe Security
0.2.2qsdqACnX3.exe.400000.0.unpack	Windows_Trojan_Pony_d5516fe8	unknown	unknown	0x13318:$a1: \Global Downloader 0x12aa1:$a2: wiseftpsrvs.bin 0x13178:$a3: SiteServer %d\SFTP 0x1316c:$a4: %s\Keychain 0x133d6:$a5: Connections.txt 0x1371d:$a6: ftpshell.fsi 0x13e78:$a7: inetcomm server passwords
0.2.2qsdqACnX3.exe.400000.0.unpack	pony	Identify Pony	Brian Wallace @botnet_hunter	0x11cb9:$s1: {%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X} 0x13ebf:$s1: {%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X} 0x11577:$s2: YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0 0x11b98:$s3: POST %s HTTP/1.0 0x11bc1:$s4: Accept-Encoding: identity, *;q=0
0.2.2qsdqACnX3.exe.400000.0.unpack	Fareit	Fareit Payload	kevoreilly	0x140f9:$string1: 0D 0A 09 09 0D 0A 0D 0A 09 20 20 20 3A 6B 74 6B 20 20 20 0D 0A 0D 0A 0D 0A 20 20 20 20 20 64 65 6C 20 20 20 20 09 20 25 31 20 20 0D 0A 09 69 66 20 20 09 09 20 65 78 69 73 74 20 09 20 20 20 25 ...
0.0.2qsdqACnX3.exe.400000.0.unpack	JoeSecurity_Pony	Yara detected Pony	Joe Security
0.0.2qsdqACnX3.exe.400000.0.unpack	Windows_Trojan_Pony_d5516fe8	unknown	unknown	0x13318:$a1: \Global Downloader 0x12aa1:$a2: wiseftpsrvs.bin 0x13178:$a3: SiteServer %d\SFTP 0x1316c:$a4: %s\Keychain 0x133d6:$a5: Connections.txt 0x1371d:$a6: ftpshell.fsi 0x13e78:$a7: inetcomm server passwords
0.0.2qsdqACnX3.exe.400000.0.unpack	pony	Identify Pony	Brian Wallace @botnet_hunter	0x11cb9:$s1: {%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X} 0x13ebf:$s1: {%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X} 0x11577:$s2: YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0 0x11b98:$s3: POST %s HTTP/1.0 0x11bc1:$s4: Accept-Encoding: identity, *;q=0
0.0.2qsdqACnX3.exe.400000.0.unpack	Fareit	Fareit Payload	kevoreilly	0x140f9:$string1: 0D 0A 09 09 0D 0A 0D 0A 09 20 20 20 3A 6B 74 6B 20 20 20 0D 0A 0D 0A 0D 0A 20 20 20 20 20 64 65 6C 20 20 20 20 09 20 25 31 20 20 0D 0A 09 69 66 20 20 09 09 20 65 78 69 73 74 20 09 20 20 20 25 ...
Click to see the 3 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 2qsdqACnX3.exe

Avira: detected

Found malware configuration

Source: 0.2.2qsdqACnX3.exe.400000.0.unpack

Malware Configuration Extractor: Pony {"C2 list": ["http://gunnylaumienphi2017.com/"]}

Multi AV Scanner detection for submitted file

Source: 2qsdqACnX3.exe	Virustotal: Detection: 77%			Perma Link
Source: 2qsdqACnX3.exe	ReversingLabs: Detection: 94%

Yara detected Pony

Source: Yara match	File source: 2qsdqACnX3.exe, type: SAMPLE
Source: Yara match	File source: 0.2.2qsdqACnX3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.2qsdqACnX3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2008897794.0000000000411000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2qsdqACnX3.exe PID: 6632, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 2qsdqACnX3.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_0040A2F4 lstrlenW,wsprintfA,wsprintfA,lstrlenW,CryptUnprotectData,LocalFree,	0_2_0040A2F4
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_0040CFA0 CertOpenSystemStoreA,CertEnumCertificatesInStore,lstrcmp,lstrcmp,CryptAcquireCertificatePrivateKey,CryptGetUserKey,CryptExportKey,CryptExportKey,CryptDestroyKey,CryptReleaseContext,CertCloseStore,	0_2_0040CFA0
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_0040B818 CryptUnprotectData,LocalFree,lstrlen,StrCmpNIA,lstrlen,StrCmpNIA,lstrlen,StrCmpNIA,	0_2_0040B818
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_0040A54F CredEnumerateA,lstrlenW,CryptUnprotectData,LocalFree,CredFree,	0_2_0040A54F
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_0040A139 WideCharToMultiByte,lstrcmpiA,lstrcmpiA,lstrcmpiA,StrStrIA,CryptUnprotectData,LocalFree,CoTaskMemFree,	0_2_0040A139
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_0040CA1F lstrlen,CryptUnprotectData,LocalFree,	0_2_0040CA1F
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_0040A706 lstrlen,CryptUnprotectData,LocalFree,	0_2_0040A706
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_00403FF9 CryptUnprotectData,LocalFree,	0_2_00403FF9

Source: 2qsdqACnX3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_00403DC3 FindFirstFileA,lstrcmpiA,lstrcmpiA,StrStrIA,FindNextFileA,FindClose,	0_2_00403DC3
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_00404E00 FindFirstFileA,lstrcmpiA,lstrcmpiA,FindNextFileA,FindClose,	0_2_00404E00
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_004086C7 FindFirstFileA,lstrcmpiA,lstrcmpiA,StrStrIA,FindNextFileA,FindClose,	0_2_004086C7
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_00404A90 FindFirstFileA,lstrcmpiA,lstrcmpiA,StrStrIA,StrStrIA,FindNextFileA,FindClose,	0_2_00404A90
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_00409414 FindFirstFileA,lstrcmpiA,lstrcmpiA,StrStrIA,StrStrIA,lstrlen,StrStrIA,StrStrIA,StrStrIA,FindNextFileA,FindClose,	0_2_00409414
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_00408543 FindFirstFileA,lstrcmpiA,lstrcmpiA,StrStrIA,FindNextFileA,FindClose,	0_2_00408543

Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://gunnylaumienphi2017.com/

Source: 2qsdqACnX3.exe, 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: ?%02XSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: 2qsdqACnX3.exe	String found in binary or memory: ?%02XSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2http://www.facebook.com/abe2869f-9b47-4cd9-a358-c22904dba7f7Microsoft_WinInet_ftp://Software\Adobe\CommonSiteServersSiteServer %d\HostSiteServer %d\WebUrlSiteServer %d\Remote DirectorySiteServer %d-UserSiteServer %d-User PW%s\KeychainSiteServer %d\SFTPDeluxeFTPsites.xmlWeb DataLogin DataSQLite format 3table() CONSTRAINTPRIMARYUNIQUECHECKFOREIGNloginsorigin_urlpassword_valueusername_valueftp://http://https://\Google\Chrome\Chromium\ChromePlusSoftware\ChromePlusInstall_Dir\Bromium\Nichrome\Comodo\RockMeltK-Meleon\K-Meleon\ProfilesEpic\Epic\EpicStaff-FTPsites.ini\Sites\Visicom Media.ftpSettings\Global DownloaderSM.archFreshFTP.SMFBlazeFtpsite.datLastPasswordLastAddressLastUserLastPortSoftware\FlashPeak\BlazeFtp\Settings\BlazeFtp.fplFTP++.Link\shell\open\commandGoFTPConnections.txt3D-FTPsites.ini\3D-FTP\SiteDesignerSOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32EasyFTP\NetSarang.xfp.rdpTERMSRV/password 51:b:username:s:full address:s:.TERMSRV/FTP NowFTPNowsites.xmlSOFTWARE\Robo-FTP 3.7\ScriptsSOFTWARE\Robo-FTP 3.7\FTPServersFTP CountFTP File%dPasswordServerNameUserIDInitialDirectoryPortNumberServerType equals www.facebook.com (Facebook)
Source: 2qsdqACnX3.exe	String found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)

Source: 2qsdqACnX3.exe	String found in binary or memory: ftp://http://https://ftp.fireFTPsites.datSeaMonkey
Source: 2qsdqACnX3.exe	String found in binary or memory: http://gunnylaumienphi2017.com/
Source: 2qsdqACnX3.exe	String found in binary or memory: http://gunnylaumienphi2017.com/YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0
Source: 2qsdqACnX3.exe	String found in binary or memory: http://https://ftp://operawand.dat_Software
Source: 2qsdqACnX3.exe, 00000000.00000003.2012707709.0000000000766000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2qsdqACnX3.exe, 00000000.00000003.2012707709.0000000000766000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 2qsdqACnX3.exe, 00000000.00000003.2012707709.0000000000766000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 2qsdqACnX3.exe, 00000000.00000003.2012707709.0000000000766000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 2qsdqACnX3.exe, 00000000.00000003.2012707709.0000000000766000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 2qsdqACnX3.exe, 00000000.00000003.2012707709.0000000000766000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 2qsdqACnX3.exe, 00000000.00000003.2012707709.0000000000766000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 2qsdqACnX3.exe, 00000000.00000002.2034670536.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: 2qsdqACnX3.exe, 00000000.00000002.2034670536.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: 2qsdqACnX3.exe, 00000000.00000002.2034670536.0000000000711000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: 2qsdqACnX3.exe, 00000000.00000003.2012707709.0000000000766000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 2qsdqACnX3.exe, 00000000.00000003.2012707709.0000000000766000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

E-Banking Fraud

Yara detected Pony

Source: Yara match	File source: 2qsdqACnX3.exe, type: SAMPLE
Source: Yara match	File source: 0.2.2qsdqACnX3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.2qsdqACnX3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2008897794.0000000000411000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2qsdqACnX3.exe PID: 6632, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 2qsdqACnX3.exe, type: SAMPLE	Matched rule: Windows_Trojan_Pony_d5516fe8 Author: unknown
Source: 2qsdqACnX3.exe, type: SAMPLE	Matched rule: Identify Pony Author: Brian Wallace @botnet_hunter
Source: 2qsdqACnX3.exe, type: SAMPLE	Matched rule: Fareit Payload Author: kevoreilly
Source: 0.2.2qsdqACnX3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Pony_d5516fe8 Author: unknown
Source: 0.2.2qsdqACnX3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Identify Pony Author: Brian Wallace @botnet_hunter
Source: 0.2.2qsdqACnX3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Fareit Payload Author: kevoreilly
Source: 0.0.2qsdqACnX3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Pony_d5516fe8 Author: unknown
Source: 0.0.2qsdqACnX3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Identify Pony Author: Brian Wallace @botnet_hunter
Source: 0.0.2qsdqACnX3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Fareit Payload Author: kevoreilly
Source: 00000000.00000000.2008897794.0000000000411000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Pony_d5516fe8 Author: unknown
Source: 00000000.00000000.2008897794.0000000000411000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Identify Pony Author: Brian Wallace @botnet_hunter
Source: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Pony_d5516fe8 Author: unknown
Source: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Identify Pony Author: Brian Wallace @botnet_hunter
Source: Process Memory Space: 2qsdqACnX3.exe PID: 6632, type: MEMORYSTR	Matched rule: Windows_Trojan_Pony_d5516fe8 Author: unknown
Source: Process Memory Space: 2qsdqACnX3.exe PID: 6632, type: MEMORYSTR	Matched rule: Identify Pony Author: Brian Wallace @botnet_hunter

Pony trojan / infostealer detected

Source: Signatures Results

: All Signatures

Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_004104C9		0_2_004104C9
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_00402CD2		0_2_00402CD2

Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: String function: 00403F6E appears 51 times
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: String function: 00401B46 appears 139 times
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: String function: 0041016C appears 42 times

Source: 2qsdqACnX3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 2qsdqACnX3.exe, type: SAMPLE	Matched rule: Windows_Trojan_Pony_d5516fe8 reference_sample = 423e792fcd00265960877482e8148a0d49f0898f4bbc190894721fde22638567, os = windows, severity = x86, creation_date = 2021-08-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Pony, fingerprint = 9d4d847f55a693a45179a904efe20afd05a92650ac47fb19ef523d469a33795f, id = d5516fe8-3b25-4c46-9e5b-111ca312a824, last_modified = 2021-10-04
Source: 2qsdqACnX3.exe, type: SAMPLE	Matched rule: pony date = 2014-08-16, author = Brian Wallace @botnet_hunter, description = Identify Pony, author_email = bwall@ballastsecurity.net
Source: 2qsdqACnX3.exe, type: SAMPLE	Matched rule: Fareit author = kevoreilly, description = Fareit Payload, cape_type = Fareit Payload
Source: 0.2.2qsdqACnX3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Pony_d5516fe8 reference_sample = 423e792fcd00265960877482e8148a0d49f0898f4bbc190894721fde22638567, os = windows, severity = x86, creation_date = 2021-08-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Pony, fingerprint = 9d4d847f55a693a45179a904efe20afd05a92650ac47fb19ef523d469a33795f, id = d5516fe8-3b25-4c46-9e5b-111ca312a824, last_modified = 2021-10-04
Source: 0.2.2qsdqACnX3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: pony date = 2014-08-16, author = Brian Wallace @botnet_hunter, description = Identify Pony, author_email = bwall@ballastsecurity.net
Source: 0.2.2qsdqACnX3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Fareit author = kevoreilly, description = Fareit Payload, cape_type = Fareit Payload
Source: 0.0.2qsdqACnX3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Pony_d5516fe8 reference_sample = 423e792fcd00265960877482e8148a0d49f0898f4bbc190894721fde22638567, os = windows, severity = x86, creation_date = 2021-08-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Pony, fingerprint = 9d4d847f55a693a45179a904efe20afd05a92650ac47fb19ef523d469a33795f, id = d5516fe8-3b25-4c46-9e5b-111ca312a824, last_modified = 2021-10-04
Source: 0.0.2qsdqACnX3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: pony date = 2014-08-16, author = Brian Wallace @botnet_hunter, description = Identify Pony, author_email = bwall@ballastsecurity.net
Source: 0.0.2qsdqACnX3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Fareit author = kevoreilly, description = Fareit Payload, cape_type = Fareit Payload
Source: 00000000.00000000.2008897794.0000000000411000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Pony_d5516fe8 reference_sample = 423e792fcd00265960877482e8148a0d49f0898f4bbc190894721fde22638567, os = windows, severity = x86, creation_date = 2021-08-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Pony, fingerprint = 9d4d847f55a693a45179a904efe20afd05a92650ac47fb19ef523d469a33795f, id = d5516fe8-3b25-4c46-9e5b-111ca312a824, last_modified = 2021-10-04
Source: 00000000.00000000.2008897794.0000000000411000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: pony date = 2014-08-16, author = Brian Wallace @botnet_hunter, description = Identify Pony, author_email = bwall@ballastsecurity.net
Source: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Pony_d5516fe8 reference_sample = 423e792fcd00265960877482e8148a0d49f0898f4bbc190894721fde22638567, os = windows, severity = x86, creation_date = 2021-08-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Pony, fingerprint = 9d4d847f55a693a45179a904efe20afd05a92650ac47fb19ef523d469a33795f, id = d5516fe8-3b25-4c46-9e5b-111ca312a824, last_modified = 2021-10-04
Source: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: pony date = 2014-08-16, author = Brian Wallace @botnet_hunter, description = Identify Pony, author_email = bwall@ballastsecurity.net
Source: Process Memory Space: 2qsdqACnX3.exe PID: 6632, type: MEMORYSTR	Matched rule: Windows_Trojan_Pony_d5516fe8 reference_sample = 423e792fcd00265960877482e8148a0d49f0898f4bbc190894721fde22638567, os = windows, severity = x86, creation_date = 2021-08-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Pony, fingerprint = 9d4d847f55a693a45179a904efe20afd05a92650ac47fb19ef523d469a33795f, id = d5516fe8-3b25-4c46-9e5b-111ca312a824, last_modified = 2021-10-04
Source: Process Memory Space: 2qsdqACnX3.exe PID: 6632, type: MEMORYSTR	Matched rule: pony date = 2014-08-16, author = Brian Wallace @botnet_hunter, description = Identify Pony, author_email = bwall@ballastsecurity.net

Source: classification engine

Classification label: mal100.troj.spyw.winEXE@5/1@0/0

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

Code function: 0_2_0040CFA0 CertOpenSystemStoreA,CertEnumCertificatesInStore,lstrcmp,lstrcmp,CryptAcquireCertificatePrivateKey,CryptGetUserKey,CryptExportKey,CryptExportKey,CryptDestroyKey,CryptReleaseContext,CertCloseStore,

0_2_0040CFA0

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

Code function: 0_2_0040273D LookupPrivilegeValueA,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,

0_2_0040273D

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

Code function: 0_2_00402ABC WTSGetActiveConsoleSessionId,CreateToolhelp32Snapshot,Process32First,StrStrIA,ProcessIdToSessionId,OpenProcess,OpenProcessToken,ImpersonateLoggedOnUser,RegOpenCurrentUser,CloseHandle,CloseHandle,CloseHandle,Process32Next,CloseHandle,

0_2_00402ABC

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

Code function: 0_2_0040A457 CoCreateInstance,StrStrIW,CoTaskMemFree,CoTaskMemFree,

0_2_0040A457

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5572:120:WilError_03

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

File created: C:\Users\user\AppData\Local\Temp\5990015.bat

Jump to behavior

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\5990015.bat" "C:\Users\user\Desktop\2qsdqACnX3.exe" "

Source: 2qsdqACnX3.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2qsdqACnX3.exe, 00000000.00000003.2013000324.0000000000753000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 2qsdqACnX3.exe	Virustotal: Detection: 77%
Source: 2qsdqACnX3.exe	ReversingLabs: Detection: 94%

Source: unknown	Process created: C:\Users\user\Desktop\2qsdqACnX3.exe "C:\Users\user\Desktop\2qsdqACnX3.exe"
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\5990015.bat" "C:\Users\user\Desktop\2qsdqACnX3.exe" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\5990015.bat" "C:\Users\user\Desktop\2qsdqACnX3.exe" "	Jump to behavior

Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: pstorec.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts

Jump to behavior

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

Code function: 0_2_0040F9DE GetTickCount,wsprintfA,GetModuleFileNameA,GetTempPathA,lstrcat,ExitProcess,CreateFileA,lstrcpy,StrRChrIA,lstrcpy,ExitProcess,lstrlen,CloseHandle,wsprintfA,LoadLibraryA,GetProcAddress,ShellExecuteA,

0_2_0040F9DE

Hooking and other Techniques for Hiding and Protection

Drops / launches Pony Loader self-deletion script - malware possibly based on Pony Loader leaked source code

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

File dump: 5990015.bat.0.dr 3880EEB1C736D853EB13B44898B718AB

Jump to dropped file

Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-10603

Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_00403DC3 FindFirstFileA,lstrcmpiA,lstrcmpiA,StrStrIA,FindNextFileA,FindClose,	0_2_00403DC3
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_00404E00 FindFirstFileA,lstrcmpiA,lstrcmpiA,FindNextFileA,FindClose,	0_2_00404E00
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_004086C7 FindFirstFileA,lstrcmpiA,lstrcmpiA,StrStrIA,FindNextFileA,FindClose,	0_2_004086C7
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_00404A90 FindFirstFileA,lstrcmpiA,lstrcmpiA,StrStrIA,StrStrIA,FindNextFileA,FindClose,	0_2_00404A90
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_00409414 FindFirstFileA,lstrcmpiA,lstrcmpiA,StrStrIA,StrStrIA,lstrlen,StrStrIA,StrStrIA,StrStrIA,FindNextFileA,FindClose,	0_2_00409414
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: 0_2_00408543 FindFirstFileA,lstrcmpiA,lstrcmpiA,StrStrIA,FindNextFileA,FindClose,	0_2_00408543

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

Code function: 0_2_0040421A GetVersionExA,GetLocaleInfoA,GetLocaleInfoA,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,

0_2_0040421A

Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: 2qsdqACnX3.exe, 00000000.00000002.2034670536.0000000000711000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlltt3d
Source: 2qsdqACnX3.exe, 00000000.00000002.2034670536.0000000000711000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 2qsdqACnX3.exe, 00000000.00000002.2034670536.0000000000711000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

API call chain: ExitProcess graph end node

graph_0-7525

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

0_2_0040F9DE

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

Code function: 0_2_0040F566 mov eax, dword ptr fs:[00000030h]

0_2_0040F566

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

Code function: 0_2_0040FF45 SetUnhandledExceptionFilter,RevertToSelf,

0_2_0040FF45

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

Code function: 0_2_0040FCA6 lstrcmpiA,LogonUserA,lstrlen,LCMapStringA,LogonUserA,LogonUserA,746D1B10,ImpersonateLoggedOnUser,RevertToSelf,746C5030,CloseHandle,

0_2_0040FCA6

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\5990015.bat" "C:\Users\user\Desktop\2qsdqACnX3.exe" "

Jump to behavior

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

Code function: 0_2_004040EF AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_004040EF

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

Code function: GetVersionExA,GetLocaleInfoA,GetLocaleInfoA,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,

0_2_0040421A

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

Code function: 0_2_0040FE97 OleInitialize,GetUserNameA,

0_2_0040FE97

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

Code function: 0_2_0040421A GetVersionExA,GetLocaleInfoA,GetLocaleInfoA,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,

0_2_0040421A

Stealing of Sensitive Information

Yara detected Pony

Source: Yara match	File source: 2qsdqACnX3.exe, type: SAMPLE
Source: Yara match	File source: 0.2.2qsdqACnX3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.2qsdqACnX3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2008897794.0000000000411000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2qsdqACnX3.exe PID: 6632, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\2qsdqACnX3.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\INSoftware\NovaFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\GlobalSCAPE\CuteFTP Lite\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\GlobalSCAPE\CuteFTP Pro\sm.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\FlashFXP\4\Quick.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\SharedSettings.ccs	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\SiteDesigner\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\CuteFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\FlashFXP\3\History.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\SharedSettings_1_0_5.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\FlashFXP\3\Sites.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\SharedSettings_1_0_5.ccs	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\GlobalSCAPE\CuteFTP Pro\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: HKEY_CURRENT_USER\Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\CoffeeCup Software\SharedSettings.ccs	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Program Files (x86)\GlobalSCAPE\CuteFTP Pro\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\SmartFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\RhinoSoft.com\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: HKEY_CURRENT_USER\Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\SharedSettings.ccs	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: HKEY_CURRENT_USER\Software\TurboFTP	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\BlazeFtp\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\SharedSettings_1_0_5.ccs	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\GlobalSCAPE\CuteFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: HKEY_LOCAL_MACHINE\Software\WOW6432Node\AceBIT	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\RhinoSoft.com\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\LeapWare\LeapFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\LeapWare\LeapFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\GPSoftware\Directory Opus\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: HKEY_CURRENT_USER\Software\AceBIT	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\FlashFXP\4\Sites.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\NetSarang\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\FTPInfo\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\GHISLER\wcx_ftp.ini	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\FileZilla\filezilla.xml	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\GHISLER\wcx_ftp.ini	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\CoffeeCup Software\SharedSettings.ccs	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\LeapWare\LeapFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\GlobalSCAPE\CuteFTP Lite\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\RhinoSoft.com\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\SharedSettings_1_0_5.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\CoffeeCup Software\SharedSettings.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Program Files (x86)\CuteFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\SharedSettings.ccs	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\GlobalSCAPE\CuteFTP\sm.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\GHISLER\wcx_ftp.ini	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\BlazeFtp\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\ExpanDrive\drives.js	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\FlashFXP\4\Sites.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\INSoftware\NovaFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\FTP Explorer\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\FTPGetter\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\FlashFXP\3\Quick.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Program Files (x86)\CuteFTP\sm.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\FTPInfo\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\FileZilla\sitemanager.xml	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\FlashFXP\4\Sites.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\GlobalSCAPE\CuteFTP Lite\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\FTP Explorer\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\CuteFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: HKEY_LOCAL_MACHINE\Software\WOW6432Node\TurboFTP	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\SmartFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: HKEY_CURRENT_USER\Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\INSoftware\NovaFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\CuteFTP\sm.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\CuteFTP\sm.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: HKEY_CURRENT_USER\Software\FTP Explorer\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\SharedSettings_1_0_5.ccs	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\GlobalSCAPE\CuteFTP Pro\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\GlobalSCAPE\CuteFTP Lite\sm.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\Frigate3\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: HKEY_CURRENT_USER\Software\MAS-Soft\FTPInfo\Setup	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\FlashFXP\3\Quick.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\FileZilla\sitemanager.xml	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\CoffeeCup Software\SharedSettings.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\TurboFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\GlobalSCAPE\CuteFTP Pro\sm.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\Frigate3\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\FlashFXP\3\Sites.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\FTPRush\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\GPSoftware\Directory Opus\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\GPSoftware\Directory Opus\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\FTPGetter\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\GlobalSCAPE\CuteFTP\sm.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\FlashFXP\3\Quick.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\Estsoft\ALFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\CoffeeCup Software\SharedSettings.ccs	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\GlobalSCAPE\CuteFTP Pro\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\GlobalSCAPE\CuteFTP Pro\sm.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\ExpanDrive\drives.js	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\ExpanDrive\drives.js	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\FlashFXP\4\Quick.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\CoffeeCup Software\SharedSettings_1_0_5.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\CuteFTP\sm.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\TurboFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\AceBIT\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Program Files (x86)\GlobalSCAPE\CuteFTP\sm.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\TurboFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Program Files (x86)\GlobalSCAPE\CuteFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\CoffeeCup Software\SharedSettings_1_0_5.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\Estsoft\ALFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\BlazeFtp\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\SharedSettings.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\FlashFXP\3\Sites.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\GlobalSCAPE\CuteFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\GlobalSCAPE\CuteFTP Lite\sm.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\FlashFXP\4\History.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: HKEY_CURRENT_USER\Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: HKEY_CURRENT_USER\Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\SharedSettings.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\AceBIT\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\FlashFXP\3\History.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\GlobalSCAPE\CuteFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\SharedSettings_1_0_5.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\GlobalSCAPE\CuteFTP\sm.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\CoffeeCup Software\SharedSettings_1_0_5.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\AceBIT\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\SharedSettings.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Windows\32BitFtp.ini	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\Estsoft\ALFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Program Files (x86)\GlobalSCAPE\CuteFTP Pro\sm.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\wcx_ftp.ini	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Program Files (x86)\GlobalSCAPE\CuteFTP Lite\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\FlashFXP\4\Quick.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\NetSarang\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\sitemanager.xml	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\3D-FTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\FTP Explorer\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\CoffeeCup Software\SharedSettings_1_0_5.ccs	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\NetSarang\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: HKEY_CURRENT_USER\Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\FileZilla\filezilla.xml	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\FTPRush\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: HKEY_CURRENT_USER\Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\CoffeeCup Software\SharedSettings.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\GlobalSCAPE\CuteFTP Lite\sm.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\FlashFXP\4\History.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\FlashFXP\3\History.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\CuteFTP\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: HKEY_LOCAL_MACHINE\Software\TurboFTP	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\FlashFXP\4\History.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\ProgramData\CoffeeCup Software\SharedSettings_1_0_5.ccs	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Local\Frigate3\	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Windows\wcx_ftp.ini	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Program Files (x86)\GlobalSCAPE\CuteFTP Lite\sm.dat	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\filezilla.xml	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	File opened: C:\Users\user\AppData\Roaming\CoffeeCup Software\SharedSettings_1_0_5.ccs	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings	Jump to behavior
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Jump to behavior

Tries to steal Mail credentials (via file registry)

Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: RegOpenKeyA,RegEnumKeyExA,RegCloseKey, PopPassword		0_2_0040E785
Source: C:\Users\user\Desktop\2qsdqACnX3.exe	Code function: RegOpenKeyA,RegEnumKeyExA,RegCloseKey, SmtpPassword		0_2_0040E785

Source: Yara match

File source: Process Memory Space: 2qsdqACnX3.exe PID: 6632, type: MEMORYSTR

Remote Access Functionality

Yara detected Pony

Source: Yara match	File source: 2qsdqACnX3.exe, type: SAMPLE
Source: Yara match	File source: 0.2.2qsdqACnX3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.2qsdqACnX3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2008897794.0000000000411000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2qsdqACnX3.exe PID: 6632, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Valid Accounts	2 Native API	1 Valid Accounts	1 Valid Accounts	1 Valid Accounts	2 OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Email Collection	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	11 Access Token Manipulation	11 Access Token Manipulation	2 Credentials in Registry	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	11 Process Injection	11 Process Injection	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	2 Data from Local System	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Install Root Certificate	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2qsdqACnX3.exe	78%	Virustotal		Browse
2qsdqACnX3.exe	95%	ReversingLabs	Win32.Infostealer.Pony
2qsdqACnX3.exe	100%	Avira	TR/PSW.Fareit.iloen
2qsdqACnX3.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://gunnylaumienphi2017.com/	1%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://gunnylaumienphi2017.com/YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0	1%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://gunnylaumienphi2017.com/	true	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://https://ftp://operawand.dat_Software	2qsdqACnX3.exe	false		unknown
https://ac.ecosia.org/autocomplete?q=	2qsdqACnX3.exe, 00000000.00000003.2012707709.0000000000766000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	2qsdqACnX3.exe, 00000000.00000003.2012707709.0000000000766000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	2qsdqACnX3.exe, 00000000.00000003.2012707709.0000000000766000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	2qsdqACnX3.exe, 00000000.00000003.2012707709.0000000000766000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
ftp://http://https://ftp.fireFTPsites.datSeaMonkey	2qsdqACnX3.exe	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	2qsdqACnX3.exe, 00000000.00000003.2012707709.0000000000766000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	2qsdqACnX3.exe, 00000000.00000003.2012707709.0000000000766000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	2qsdqACnX3.exe, 00000000.00000003.2012707709.0000000000766000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	2qsdqACnX3.exe, 00000000.00000003.2012707709.0000000000766000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	2qsdqACnX3.exe, 00000000.00000003.2012707709.0000000000766000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://gunnylaumienphi2017.com/YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0	2qsdqACnX3.exe	false	1%, Virustotal, Browse	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523193
Start date and time:	2024-10-01 09:26:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2qsdqACnX3.exe renamed because original name is a hash value
Original Sample Name:	73339cacdb37937c47ea7668ac3a1017.exe
Detection:	MAL
Classification:	mal100.troj.spyw.winEXE@5/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 81 Number of non-executed functions: 41
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Process:	C:\Users\user\Desktop\2qsdqACnX3.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	94
Entropy (8bit):	3.233204299824007
Encrypted:	false
SSDEEP:	3:k4Zoa5/kFWJFFN6dAFZkMFlGl/AVFn:k/0/kFY/NDFZotwFn
MD5:	3880EEB1C736D853EB13B44898B718AB
SHA1:	4EEC9D50360CD815211E3C4E6BDD08271B6EC8E6
SHA-256:	936D9411D5226B7C5A150ECAF422987590A8870C8E095E1CAA072273041A86E7
SHA-512:	3EAA3DDDD7A11942E75ACD44208FBE3D3FF8F4006951CD970FB9AB748C160739409803450D28037E577443504707FC310C634E9DC54D0C25E8CFE6094F017C6B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......... :ktk ...... del . %1 ...if .. exist . %1 . goto .. ktk.. del . %0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.198880234677548
TrID:	Win32 Executable (generic) a (10002005/4) 99.56% Win32 EXE Yoda's Crypter (26571/9) 0.26% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	2qsdqACnX3.exe
File size:	83'968 bytes
MD5:	73339cacdb37937c47ea7668ac3a1017
SHA1:	b32d273a752ad25173e26a110ae05acbabf3f15d
SHA256:	d0abb0bd329f13afadfb0bbf6730f2233488b8c6c6f5e593d61d91b20fe8b772
SHA512:	6629b294d431b49f7d3272dc0bcaa85eaa2a82f0f3eceea27ff071ff4b7048af2b0a70bed658ad22e53b6d70d239399f477d5a2122d84bb6e28435678eefd41d
SSDEEP:	1536:YSSH/BiqTiTQROZFdQ6sPr2F7oW6fQrNZL3cncOaEzSkzmeL:ZS5MvXdfsPr2F7pyQhDOaEzKeL
TLSH:	0683F702F481F0F1C1A126B137C153B1E7F99E79783A4D5EEF4C89847DA628B7B16462
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...............2.....N....................@..........................`.............................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40ff8b
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x66F7AFAD [Sat Sep 28 07:26:37 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	8d644d676851d7b6f34d624a7462831f

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
pop ebp
push 0040FF99h
clc
jc 00007F0B25041B13h
ret
jmp far eax
push esp
add byte ptr [eax], al
add byte ptr [ecx+0000000Ah], bh
xor edx, edx
div ecx
cmp edx, 05h
jne 00007F0B25041B14h
jmp 00007F0B25041B14h
jmp 00007F0B25041AFBh
call 00007F0B25041A92h
push 00000000h
call 00007F0B25041C41h
jmp dword ptr [00415020h]
jmp dword ptr [00415024h]
jmp dword ptr [00415028h]
jmp dword ptr [0041502Ch]
jmp dword ptr [00415030h]
jmp dword ptr [00415034h]
jmp dword ptr [00415038h]
jmp dword ptr [0041503Ch]
jmp dword ptr [00415040h]
jmp dword ptr [00415044h]
jmp dword ptr [00415048h]
jmp dword ptr [0041504Ch]
jmp dword ptr [00415050h]
jmp dword ptr [00415054h]
jmp dword ptr [00415058h]
jmp dword ptr [0041505Ch]
jmp dword ptr [00415060h]
jmp dword ptr [00415064h]
jmp dword ptr [00415068h]
jmp dword ptr [0041506Ch]
jmp dword ptr [00415070h]
jmp dword ptr [00415074h]
jmp dword ptr [00415078h]
jmp dword ptr [0041507Ch]
jmp dword ptr [00415080h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14de4	0xb4	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xfd2b	0xfe00	88216a614d6c7f5dbcdad643224e119e	False	0.45758489173228345	data	5.993619419981743	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x11000	0x4d58	0x4800	0d9987a474ebc4800e4e69b9ac14b2ec	False	0.4222005208333333	data	5.272866548522773	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
KERNEL32.DLL	CreateFileA, ReadFile, CloseHandle, WriteFile, lstrlenA, GlobalLock, GlobalUnlock, LocalFree, LocalAlloc, GetTickCount, lstrcpyA, lstrcatA, GetFileAttributesA, ExpandEnvironmentStringsA, GetFileSize, CreateFileMappingA, MapViewOfFile, UnmapViewOfFile, LoadLibraryA, GetProcAddress, GetTempPathA, CreateDirectoryA, DeleteFileA, GetCurrentProcess, WideCharToMultiByte, GetLastError, lstrcmpA, CreateToolhelp32Snapshot, Process32First, OpenProcess, Process32Next, FindFirstFileA, lstrcmpiA, FindNextFileA, FindClose, GetModuleHandleA, GetVersionExA, GetLocaleInfoA, GetSystemInfo, GetWindowsDirectoryA, GetPrivateProfileStringA, SetCurrentDirectoryA, GetPrivateProfileSectionNamesA, GetPrivateProfileIntA, GetCurrentDirectoryA, lstrlenW, MultiByteToWideChar, Sleep, GetModuleFileNameA, LCMapStringA, ExitProcess, SetUnhandledExceptionFilter
advapi32.dll	RegOpenKeyExA, RegQueryValueExA, RegCloseKey, RegOpenKeyA, RegEnumKeyExA, RegCreateKeyA, RegSetValueExA, IsTextUnicode, RegOpenCurrentUser, RegEnumValueA, GetUserNameA
ole32.dll	CreateStreamOnHGlobal, GetHGlobalFromStream, CoCreateGuid, CoTaskMemFree, CoCreateInstance, OleInitialize
shlwapi.dll	StrStrIA, StrRChrIA, StrToIntA, StrStrA, StrCmpNIA, StrStrIW
user32.dll	wsprintfA
userenv.dll	LoadUserProfileA, UnloadUserProfile
wininet.dll	InternetCrackUrlA, InternetCreateUrlA
wsock32.dll	inet_addr, gethostbyname, socket, connect, closesocket, send, select, recv, setsockopt, WSAStartup

Target ID:	0
Start time:	03:26:55
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\2qsdqACnX3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2qsdqACnX3.exe"
Imagebase:	0x400000
File size:	83'968 bytes
MD5 hash:	73339CACDB37937C47EA7668AC3A1017
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Pony, Description: Yara detected Pony, Source: 00000000.00000000.2008897794.0000000000411000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Pony_d5516fe8, Description: unknown, Source: 00000000.00000000.2008897794.0000000000411000.00000008.00000001.01000000.00000003.sdmp, Author: unknown Rule: pony, Description: Identify Pony, Source: 00000000.00000000.2008897794.0000000000411000.00000008.00000001.01000000.00000003.sdmp, Author: Brian Wallace @botnet_hunter Rule: JoeSecurity_Pony, Description: Yara detected Pony, Source: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Pony_d5516fe8, Description: unknown, Source: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmp, Author: unknown Rule: pony, Description: Identify Pony, Source: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmp, Author: Brian Wallace @botnet_hunter
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:26:57
Start date:	01/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\5990015.bat" "C:\Users\user\Desktop\2qsdqACnX3.exe" "
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:26:57
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	30.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Executed Functions

Function 0040F9DE Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 158
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040FA0B
wsprintfA.USER32 ref: 0040FA19
GetModuleFileNameA.KERNEL32(?,00000104,00000105,00000105,00000105,?,00000105,0040F9F2), ref: 0040FA79
GetTempPathA.KERNEL32(00000104,?,?,00000104,00000105,00000105,00000105,?,00000105,0040F9F2), ref: 0040FA8F
lstrcat.KERNEL32(?,?), ref: 0040FAA3
ExitProcess.KERNEL32(?,C0000000,00000003,00000000,00000002,00000000,00000000,00000104,?,?,00000104,00000105,00000105,00000105,?,00000105), ref: 0040FABC
lstrcpy.KERNEL32(?,?), ref: 0040FAD3
StrRChrIA.SHLWAPI(?,00000000,0000005C,?,?,?,C0000000,00000003,00000000,00000002,00000000,00000000,00000104,?,?,00000104), ref: 0040FADF
lstrcpy.KERNEL32(00000001,?), ref: 0040FAED

Strings

:ktk del %1 if exist %1 goto ktk del %0 , xrefs: 0040FB0F, 0040FB1A
%d.bat, xrefs: 0040FA11
ShellExecuteA, xrefs: 0040FB58
"%s" , xrefs: 0040FB3A
open, xrefs: 0040FB71
shell32.dll, xrefs: 0040FB4A

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: lstrcpy$CountExitFileModuleNamePathProcessTempTicklstrcatwsprintf
String ID: :ktk del %1 if exist %1 goto ktk del %0 $ "%s" $%d.bat$ShellExecuteA$open$shell32.dll
API String ID: 629621046-4169620016
Opcode ID: 2d4526de1fbfecd3fbb4542c10101f8a0fcd70485bed2be72a517248322137ac
Instruction ID: f48094f2bf34160f77960da2a726bb2ff1328f347839c3ffb5de8ceac10d9150
Opcode Fuzzy Hash: 2d4526de1fbfecd3fbb4542c10101f8a0fcd70485bed2be72a517248322137ac
Instruction Fuzzy Hash: 64418230B44205BADF2976A19C13FAE7A67AF85704F20803EB215F62E1DEB94D545A1C

Function 0040E785 Relevance: 22.9, APIs: 3, Strings: 10, Instructions: 174
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(?,?,?), ref: 0040E798
RegEnumKeyExA.ADVAPI32(?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 0040E7CC
RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 0040EA87

Strings

SmtpPort, xrefs: 0040E8CA
PopServer, xrefs: 0040E834
PopPassword, xrefs: 0040E88F
EmailAddress, xrefs: 0040E7FE
PopPort, xrefs: 0040E854
Technology, xrefs: 0040E819
PopAccount, xrefs: 0040E86F
SmtpAccount, xrefs: 0040E8E5
SmtpServer, xrefs: 0040E8AA
SmtpPassword, xrefs: 0040E905

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: EmailAddress$PopAccount$PopPassword$PopPort$PopServer$SmtpAccount$SmtpPassword$SmtpPort$SmtpServer$Technology
API String ID: 1332880857-2111798378
Opcode ID: 1efb3267f2bb3610b73d164facee8bd75a0b0d5d416e8100a6d0dd2b11f23b77
Instruction ID: 17efc9946458755bb64bf36a63b1628e6639bf8bc39f30ba5671466992181c26
Opcode Fuzzy Hash: 1efb3267f2bb3610b73d164facee8bd75a0b0d5d416e8100a6d0dd2b11f23b77
Instruction Fuzzy Hash: CF718331840118BBCF226F51CD42BDDBAB6BF04704F14C4BAB659750B1DB7A5BA1AF88

Function 0040CFA0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 142
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CertOpenSystemStoreA.CRYPT32(00000000,0041377D), ref: 0040D026
CertEnumCertificatesInStore.CRYPT32(00000000), ref: 0040D03F
lstrcmp.KERNEL32(?,2.5.29.37), ref: 0040D070

Part of subcall function 00401769: LocalAlloc.KERNEL32(00000040,00402200,?,00402280,?), ref: 00401777

lstrcmp.KERNEL32(?,0041378A), ref: 0040D0A8
CryptAcquireCertificatePrivateKey.CRYPT32(00000000,00000000,00000000,?,?,00000000), ref: 0040D0C4
CryptGetUserKey.ADVAPI32(?,?,?), ref: 0040D0DC
CryptExportKey.ADVAPI32(?,00000000,00000007,00000000,00000000,?), ref: 0040D0F5
CryptExportKey.ADVAPI32(?,00000000,00000007,00000000,?,?,?), ref: 0040D11A
CryptDestroyKey.ADVAPI32(?), ref: 0040D158
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040D163
CertCloseStore.CRYPT32(00000000,00000000), ref: 0040D18B

Strings

2.5.29.37, xrefs: 0040D069

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: Crypt$CertStore$Exportlstrcmp$AcquireAllocCertificateCertificatesCloseContextDestroyEnumLocalOpenPrivateReleaseSystemUser
String ID: 2.5.29.37
API String ID: 2649496969-3842544949
Opcode ID: 90d45447d648ce5a9db7bc290ff7048b737502a1bb15dbf226a8ee68cf438de0
Instruction ID: 7c639e010cdb965f3efc64817a9e83747879526ca5898d1d50ecab408f71e8b0
Opcode Fuzzy Hash: 90d45447d648ce5a9db7bc290ff7048b737502a1bb15dbf226a8ee68cf438de0
Instruction Fuzzy Hash: 52511731A00209FADF22ABA1DC09BEEBB75FB04345F108436F611791F4DB796994DB58

Function 00404A90 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 107
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 00404B00
lstrcmpiA.KERNEL32(00411EA6,?), ref: 00404B29
lstrcmpiA.KERNEL32(00411EA8,?), ref: 00404B46
FindNextFileA.KERNEL32(?,?,?,.ini,00000000,?), ref: 00404BF5
FindClose.KERNEL32(?,?,?,?,.ini,00000000,?), ref: 00404C08

Part of subcall function 00401BCD: lstrlen.KERNEL32(?), ref: 00401BEE
Part of subcall function 00401BCD: lstrlen.KERNEL32(00000000,?), ref: 00401BF8
Part of subcall function 00401BCD: lstrcpy.KERNEL32(00000000,?), ref: 00401C0C
Part of subcall function 00401BCD: lstrcat.KERNEL32(00000000,00000000), ref: 00401C15

Strings

*.*, xrefs: 00404ACF
Sites\, xrefs: 00404BC3
\*.*, xrefs: 00404AC0
.ini, xrefs: 00404B8E

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: Find$Filelstrcmpilstrlen$CloseFirstNextlstrcatlstrcpy
String ID: *.*$.ini$Sites\$\*.*
API String ID: 3040542784-999409347
Opcode ID: c47b076886affc71d4b97aea9d9e2028b5f846fbe9e34eebce5f31f813dfcac2
Instruction ID: 014027ab060015c7d8668547a98ec7e6f392db7afa0d1d618ff4209e3bbb5fca
Opcode Fuzzy Hash: c47b076886affc71d4b97aea9d9e2028b5f846fbe9e34eebce5f31f813dfcac2
Instruction Fuzzy Hash: FA3140B0940209AADF20BB61DC41FEA76B8AB84304F1045B7BA09B51F1D7BDDED09E5C

Function 0040421A Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 139
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(0000009C), ref: 00404263
GetLocaleInfoA.KERNEL32(00000400,00001002,?,000003FF,00000400,0000009C), ref: 004042E8
GetLocaleInfoA.KERNEL32(00000400,00001001,?,000003FF,00000400,00001002,?,000003FF,00000400,0000009C), ref: 00404311
GetModuleHandleA.KERNEL32(kernel32.dll,?,00000000,00000400,00001001,?,000003FF,00000400,00001002,?,000003FF,00000400,0000009C), ref: 004043C6
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 004043E5
GetNativeSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll,?,00000000,00000400,00001001,?,000003FF,00000400,00001002,?,000003FF,00000400,0000009C), ref: 004043F5
GetSystemInfo.KERNEL32(?,kernel32.dll,?,00000000,00000400,00001001,?,000003FF,00000400,00001002,?,000003FF,00000400,0000009C), ref: 00404403

Strings

HWID, xrefs: 0040433F
GetNativeSystemInfo, xrefs: 004043DA
kernel32.dll, xrefs: 004043C1

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: Info$LocaleSystem$AddressHandleModuleNativeProcVersion
String ID: GetNativeSystemInfo$HWID$kernel32.dll
API String ID: 1787888500-92997708
Opcode ID: cdb3d6fbab9e39f66c7821b3118941f5d0585d140dabf13a675d0ffb5a13bf06
Instruction ID: ce2023bde6a4fb6ecb372171715b32991a17bfc6e2c9532a6d1893fd02629070
Opcode Fuzzy Hash: cdb3d6fbab9e39f66c7821b3118941f5d0585d140dabf13a675d0ffb5a13bf06
Instruction Fuzzy Hash: 76515170A40218BEEF216BA1CC42F9D7A75AF81348F1040BAB749790F1CBB94ED59F59

Function 004086C7 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 77filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 0040871C
lstrcmpiA.KERNEL32(00411EA6,?), ref: 0040874F
lstrcmpiA.KERNEL32(00411EA8,?), ref: 00408769
StrStrIA.SHLWAPI(?,opera,00000000,00411EA8,?,00411EA6,?,00000000,?), ref: 004087AE
FindNextFileA.KERNEL32(?,?,00000000,?), ref: 004087DC
FindClose.KERNEL32(?,?,?,00000000,?), ref: 004087EF

Strings

wand.dat, xrefs: 004087B7
opera, xrefs: 004087A3
\*.*, xrefs: 004086EB

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: Find$Filelstrcmpi$CloseFirstNext
String ID: \*.*$opera$wand.dat
API String ID: 3663067366-3278183560
Opcode ID: 7aeb2c8a1a2e94ae6af49b6683e94d244e1474266b7b127cdedb6c7c130d2898
Instruction ID: 557ed418c4cd54b267a256c148f0d4b8f8e25ee2e48a42878aee2fa7f092eeb5
Opcode Fuzzy Hash: 7aeb2c8a1a2e94ae6af49b6683e94d244e1474266b7b127cdedb6c7c130d2898
Instruction Fuzzy Hash: AD31507090021DAADF20AB61CD01FEE77B5AB14308F1044BBB548B61A1EBB99FC09F58

Function 00403DC3 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 117filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 00403E33
lstrcmpiA.KERNEL32(00411EA6,?), ref: 00403E60
lstrcmpiA.KERNEL32(00411EA8,?), ref: 00403E7D
FindNextFileA.KERNEL32(?,?,?,00000000,00000000,?), ref: 00403F47
FindClose.KERNEL32(?,?,?,?,00000000,00000000,?), ref: 00403F5A

Part of subcall function 00401BCD: lstrlen.KERNEL32(?), ref: 00401BEE
Part of subcall function 00401BCD: lstrlen.KERNEL32(00000000,?), ref: 00401BF8
Part of subcall function 00401BCD: lstrcpy.KERNEL32(00000000,?), ref: 00401C0C
Part of subcall function 00401BCD: lstrcat.KERNEL32(00000000,00000000), ref: 00401C15

Strings

*.*, xrefs: 00403E02
\*.*, xrefs: 00403DF3

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: Find$Filelstrcmpilstrlen$CloseFirstNextlstrcatlstrcpy
String ID: *.*$\*.*
API String ID: 3040542784-1692270452
Opcode ID: b44ad3ce1885f3e95d41e77a56157922eba595f19b766e5f8d278ed35765075c
Instruction ID: bfff32b9704a049f1e41c3d6a2529012e5f38b11855976b5e9acbc6b14058c4d
Opcode Fuzzy Hash: b44ad3ce1885f3e95d41e77a56157922eba595f19b766e5f8d278ed35765075c
Instruction Fuzzy Hash: 56413E3090020AAADF21AF61CC02FEA7F79AF04305F1045B7B909B51F1D7799B909A99

Function 0040A2F4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 116stringencryptionCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 0040A2FE
wsprintfA.USER32 ref: 0040A37D
lstrlenW.KERNEL32(?,?), ref: 0040A3C3
CryptUnprotectData.CRYPT32(00000000,00000000,?,00000000,00000000,00000001,?), ref: 0040A406
LocalFree.KERNEL32(00000000), ref: 0040A43D

Strings

%02X, xrefs: 0040A344, 0040A374
Software\Microsoft\Internet Explorer\IntelliForms\Storage2, xrefs: 0040A39B

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: lstrlen$CryptDataFreeLocalUnprotectwsprintf
String ID: %02X$Software\Microsoft\Internet Explorer\IntelliForms\Storage2
API String ID: 1926481713-2450551051
Opcode ID: e543d0b0b507645461472ba9cc320ac6c87161f1aef8077e7e2bdd713baf0028
Instruction ID: 260137c0291e22f6ba060bb8647dd68ce290b85e1b23a851725c006554f05f3d
Opcode Fuzzy Hash: e543d0b0b507645461472ba9cc320ac6c87161f1aef8077e7e2bdd713baf0028
Instruction Fuzzy Hash: 9C413C72C10218EBDF11AFA0DC06AEDBB79FF08318F14803AF910B51A1D7B99A55DB59

Function 00404E00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 00404E6F
lstrcmpiA.KERNEL32(00411EA6,?), ref: 00404E9E
lstrcmpiA.KERNEL32(00411EA8,?), ref: 00404EB8
FindNextFileA.KERNEL32(?,?,00000000,?,00000000), ref: 00404F10
FindClose.KERNEL32(?,?,?,00000000,?,00000000), ref: 00404F23

Strings

\*.*, xrefs: 00404E3E

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: Find$Filelstrcmpi$CloseFirstNext
String ID: \*.*
API String ID: 3663067366-1173974218
Opcode ID: 821db13aac8855ccce741e34619079f7ce0c089b5c8ac5f797a5545d8a7e2f9b
Instruction ID: 6a67d0b90606cd11d2a3638aa92bbe6080bb9e2c124e64ba3ab12328cbcb17a4
Opcode Fuzzy Hash: 821db13aac8855ccce741e34619079f7ce0c089b5c8ac5f797a5545d8a7e2f9b
Instruction Fuzzy Hash: 3D31FDB0900219AADF21AB61CC41EEEB7B9AF44304F0045BBBA18B51F1D7799ED19F58

Function 0040A457 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004131CB,00000000,00000005,004131DB,?), ref: 0040A46F
StrStrIW.SHLWAPI(00000000,004131FB), ref: 0040A4E6
CoTaskMemFree.OLE32(00000000,00000000,004131FB), ref: 0040A511
CoTaskMemFree.OLE32(00000000,00000000,00000000,004131FB), ref: 0040A51F

Strings

http://www.facebook.com/, xrefs: 0040A53E
(, xrefs: 0040A4AB

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: FreeTask$CreateInstance
String ID: ($http://www.facebook.com/
API String ID: 2903366249-3677894361
Opcode ID: b166dd6a5ce2f70902b6da10580f869f0ae24ff8d6d8124b56e15d65d62aef3d
Instruction ID: 432045e52bd66d4fe49fde4f2c870db2b10b178aa535912c656550905345e8ea
Opcode Fuzzy Hash: b166dd6a5ce2f70902b6da10580f869f0ae24ff8d6d8124b56e15d65d62aef3d
Instruction Fuzzy Hash: D831F731A00209FBDF119F90DC49BDEBBB5BF08308F248166E500B6290D7B99AD5DB59

Function 0040273D Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 00402778
GetCurrentProcess.KERNEL32 ref: 00402782
OpenProcessToken.ADVAPI32(00000000,00000020,00000000), ref: 00402790
AdjustTokenPrivileges.KERNELBASE(00000000,00000000,?,00000010,00000000,00000000), ref: 004027D2
CloseHandle.KERNEL32(00000000), ref: 004027E6

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: 9e21f3fd3e68ce677e23c3b55d49d999316dbdf05d850c254425d8fa8ea8784b
Instruction ID: 8b23b7d22403577f927a3a331623c1ec88f7fce9aa05f6b36c9706ca18c0f2cc
Opcode Fuzzy Hash: 9e21f3fd3e68ce677e23c3b55d49d999316dbdf05d850c254425d8fa8ea8784b
Instruction Fuzzy Hash: 0611213591010AEFEF119B94DD4DBEEBBB5BB04344F108536A111B55E0D7F84A44CB59

Function 0040FE97 Relevance: 3.0, APIs: 2, Instructions: 28comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32 ref: 0040FE97
GetUserNameA.ADVAPI32(?,00000101), ref: 0040FEE7

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: InitializeNameUser
String ID:
API String ID: 2272643758-0
Opcode ID: bbeb51275df44be299aa57c46db9fa5abcaf4f97a742a1450cd261d66885c8cc
Instruction ID: e26f2e66d9dcda26697d7491d2630af3795e62fece7ce76a808f27638715b85c
Opcode Fuzzy Hash: bbeb51275df44be299aa57c46db9fa5abcaf4f97a742a1450cd261d66885c8cc
Instruction Fuzzy Hash: ECF01C70654201A9CB20BBB2D906ADC39A5AB0038CF10447FB500B19F3EBFD44849A6D

Function 0040FF45 Relevance: 3.0, APIs: 2, Instructions: 14COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0040FF45
RevertToSelf.ADVAPI32 ref: 0040FF6B

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: ExceptionFilterRevertSelfUnhandled
String ID:
API String ID: 669012916-0
Opcode ID: 204b044f3cc013be6c6188bff45fc5f4e677cf5a7f2a8a70e96d9e0d528a0934
Instruction ID: 1ef4db78a8eeff073eebb63f225d7f1ff4716855c3f03a9c52e7af2739d389e1
Opcode Fuzzy Hash: 204b044f3cc013be6c6188bff45fc5f4e677cf5a7f2a8a70e96d9e0d528a0934
Instruction Fuzzy Hash: 05D0677418564189E631BBF3945A7CD3A606B0530DF54803FA64060DF3CFBE148DC9AE

Function 0040F566 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

!AA, xrefs: 0040F582

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID:
String ID: !AA
API String ID: 0-779614855
Opcode ID: c2242ef122f4b4731c008e401a651a78bd98daaf91efc53295796e22f2dbc53f
Instruction ID: e439f24111ecda037a6ba224461d6446448cd6da93f758e11ff317597baed0f2
Opcode Fuzzy Hash: c2242ef122f4b4731c008e401a651a78bd98daaf91efc53295796e22f2dbc53f
Instruction Fuzzy Hash: DC118B35604284FFDB225F05DD01B967F65EB81B50F208877F80AA19F2C37E49A69A4D

Function 004055C1 Relevance: 36.8, APIs: 3, Strings: 18, Instructions: 76
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(?,?), ref: 00405661
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 00405691
RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 004056DF

Strings

Last Server Path, xrefs: 00405630
Path, xrefs: 00405602
ServerType, xrefs: 004055FD
Server Type, xrefs: 004055CF
Server.Port, xrefs: 00405607
Host, xrefs: 004055E3
Last Server Type, xrefs: 0040562B
Last Server User, xrefs: 0040563A
Pass, xrefs: 004055E8
User, xrefs: 004055DE
Server.Pass, xrefs: 00405616
Last Server Pass, xrefs: 00405644
Server.Host, xrefs: 00405611
Remote Dir, xrefs: 004055D4
Last Server Port, xrefs: 00405635
Last Server Host, xrefs: 0040563F
Port, xrefs: 004055D9
Server.User, xrefs: 0040560C

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: Host$Last Server Host$Last Server Pass$Last Server Path$Last Server Port$Last Server Type$Last Server User$Pass$Path$Port$Remote Dir$Server Type$Server.Host$Server.Pass$Server.Port$Server.User$ServerType$User
API String ID: 1332880857-44262141
Opcode ID: bc12ebd6ed49e13805bbd51c7b93d4968f403f2a445392b3feca5043dfa8c3b2
Instruction ID: 6256b6819b4c46cd2bc8a3c44f1df6facdaf933e4f51f1a6b866da70e3a32d03
Opcode Fuzzy Hash: bc12ebd6ed49e13805bbd51c7b93d4968f403f2a445392b3feca5043dfa8c3b2
Instruction Fuzzy Hash: ED21F83568020CBADF116A61CE42FDE7A65AB04B04F20C567B924B50E1DBFD5AE0AF5C

Function 00401E8E Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 172
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,?), ref: 00401EFB
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000FFF,00000000,00000000,00000000,00000000), ref: 00401F3B
lstrlen.KERNEL32(?,00000000,00000000,00000000,?,00000000,?,00000FFF,00000000,00000000,00000000,00000000,?,00000000,?,00000FFF), ref: 00401FEE
lstrlen.KERNEL32(?,00000000,?,00000000,?,00000FFF,00000000,00000000,00000000,00000000,?,00000000,?,00000FFF,00000000,00000000), ref: 00402027

Part of subcall function 00401752: LocalFree.KERNEL32(00000000,?,004022A7,?,?,?,?,?,?), ref: 0040175E

RegCloseKey.ADVAPI32(?,?,00000000,?,00000FFF,00000000,00000000,00000000,00000000), ref: 0040205E
GetHGlobalFromStream.OLE32(?,?,?,?), ref: 0040208A
GlobalLock.KERNEL32(?), ref: 004020BA
GlobalUnlock.KERNEL32(?), ref: 004020D9
GetHGlobalFromStream.OLE32(?,?,?,?,?,?), ref: 004020EB
GlobalLock.KERNEL32(?), ref: 0040211B
GlobalUnlock.KERNEL32(?), ref: 0040213A

Part of subcall function 00401769: LocalAlloc.KERNEL32(00000040,00402200,?,00402280,?), ref: 00401777

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00401EF1, 00401F4D
UninstallString, xrefs: 00401F83
DisplayName, xrefs: 00401FC3

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: Global$FromLocalLockStreamUnlocklstrlen$AllocCloseEnumFreeOpen
String ID: DisplayName$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
API String ID: 4234118056-981893429
Opcode ID: 10c08c6e89e0d03a55878e87c3fa188f42c1e7650d9481c1c75df394e4181a56
Instruction ID: badc67223168fa67c5ee47ab51c24d6e14ff1f2165c540af953b6d676deb288d
Opcode Fuzzy Hash: 10c08c6e89e0d03a55878e87c3fa188f42c1e7650d9481c1c75df394e4181a56
Instruction Fuzzy Hash: 16614B74900168BADB31AB61CD46BEA7679EB04344F0040BBB688B11F1D7FD5EC4AE68

Function 004029D6 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

S-1-5-18, xrefs: 00402A8D

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID:
String ID: S-1-5-18
API String ID: 0-4289277601
Opcode ID: 8e3158d1a93bde16ea37971c10a468597ac152d2a6ecb3ea59d04bf08c7c97c6
Instruction ID: 36688ae97771a16eb0cbb91699016dc6f457bd45ac61167d36d0fc4b3f5269ed
Opcode Fuzzy Hash: 8e3158d1a93bde16ea37971c10a468597ac152d2a6ecb3ea59d04bf08c7c97c6
Instruction Fuzzy Hash: C5213D30B00209BEDF219BA5DD8ABEE7BB5AF01748F104476F101B15E1EBB99944DB58

Function 004062AC Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(?,?), ref: 004062C2
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 004062F6
RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 00406529

Strings

PasswordType, xrefs: 004063EE
Port, xrefs: 004063AA
Host, xrefs: 0040634B
Login, xrefs: 00406369
Password, xrefs: 0040632D
InitialPath, xrefs: 00406387

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: Host$InitialPath$Login$Password$PasswordType$Port
API String ID: 1332880857-4069465341
Opcode ID: 333cdb783cf6d04b105b3be37216fa7615c6c58f5be93e92b63bab62230026b0
Instruction ID: f54a0b34a13648c7f2de88a23b550de72a796d31f471fcede32365af730f2905
Opcode Fuzzy Hash: 333cdb783cf6d04b105b3be37216fa7615c6c58f5be93e92b63bab62230026b0
Instruction Fuzzy Hash: 1E51D631940118EADF226F51DD41BE9BBB9BF04304F14C0BAB549750B1DBBA5EA1EF88

Function 0040CC54 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 147
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(?,?,?), ref: 0040CC67
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 0040CC9B
RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 0040CEA4

Strings

PortNumber, xrefs: 0040CD2B
UserID, xrefs: 0040CD0B
InitialDirectory, xrefs: 0040CD71
ServerName, xrefs: 0040CCF0
ServerType, xrefs: 0040CD8C
Password, xrefs: 0040CCD5

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: InitialDirectory$Password$PortNumber$ServerName$ServerType$UserID
API String ID: 1332880857-2649023343
Opcode ID: 102501fe7d6983fb4ce4816fb803e742d1a2c4c47817e05f00dff8f142c619ea
Instruction ID: 363f7e0d49be60193d8d738e401c9fb1663db730a6c144a8acea58420cec79c7
Opcode Fuzzy Hash: 102501fe7d6983fb4ce4816fb803e742d1a2c4c47817e05f00dff8f142c619ea
Instruction Fuzzy Hash: CE51C371800118FADF226F61CD82BDDBBB9BF04304F10C1BAB558750B1DB7A5A91AF98

Function 0040779C Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(?,?,?), ref: 004077AF
RegEnumKeyExA.ADVAPI32(?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 004077E3
RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 004079F9

Strings

HostName, xrefs: 00407836
Password, xrefs: 0040781B
RemoteDirectory, xrefs: 0040786C
PortNumber, xrefs: 0040788C
FSProtocol, xrefs: 004078DA
UserName, xrefs: 00407851

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: FSProtocol$HostName$Password$PortNumber$RemoteDirectory$UserName
API String ID: 1332880857-3874328862
Opcode ID: 4a021aa840e134b11541bbb7fc7602dc1ba3e8ef8cc3bbf4944d3ea423132fef
Instruction ID: 2510d6a40b605ee05c49857dae87127b44a85cf62aaf35441b724d9e07d5eb59
Opcode Fuzzy Hash: 4a021aa840e134b11541bbb7fc7602dc1ba3e8ef8cc3bbf4944d3ea423132fef
Instruction Fuzzy Hash: 5C51D57190411CEADF226F51CD42BDDBBB5BF04304F10C0BAB548750B2DBBA6A91AF89

Function 0040D844 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 133
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(?,?,?), ref: 0040D857
RegEnumKeyExA.ADVAPI32(?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 0040D88B
RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 0040DA74

Strings

FTP destination port, xrefs: 0040D919
FTP destination catalog, xrefs: 0040D934
FTP destination user, xrefs: 0040D8DE
FTP profiles, xrefs: 0040D954
FTP destination server, xrefs: 0040D8C3
FTP destination password, xrefs: 0040D8F9

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: FTP destination catalog$FTP destination password$FTP destination port$FTP destination server$FTP destination user$FTP profiles
API String ID: 1332880857-3620412361
Opcode ID: a32b4bd4c164d7361dc0d4439a1349ca33acaaaa7ec1cf80291e72e22fe995e8
Instruction ID: 90d5fe3b6cf1126b5e6c573dd5c1e4be20dc213f4b7a04e65ac77be63d2f89e1
Opcode Fuzzy Hash: a32b4bd4c164d7361dc0d4439a1349ca33acaaaa7ec1cf80291e72e22fe995e8
Instruction Fuzzy Hash: C4519571940118FBDF226F91CC42BDDBAB5BF04304F10C4BAB549750B1DB7A5AA59F88

Function 00407AEE Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 126
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(?,?,?), ref: 00407B01
RegEnumKeyExA.ADVAPI32(?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 00407B35
RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 00407CFD

Strings

ServerType, xrefs: 00407BF9
Url, xrefs: 00407B8D
PassWord, xrefs: 00407B72
UserName, xrefs: 00407BA8
RootDirectory, xrefs: 00407BC3
Port, xrefs: 00407BDE

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PassWord$Port$RootDirectory$ServerType$Url$UserName
API String ID: 1332880857-2128033141
Opcode ID: 5acf38d65e4bdc86f7d7c70c30d041cec79a463b2ff235d56f61567fe9a4ba08
Instruction ID: 35a2c5012d915438295930f9c11e6a977943eca2b7189a6a68ac68a7359c4362
Opcode Fuzzy Hash: 5acf38d65e4bdc86f7d7c70c30d041cec79a463b2ff235d56f61567fe9a4ba08
Instruction Fuzzy Hash: 0251953194411CBADF226F51CD42BDDBBB5BF04304F10C0BAB559750B2DBBA5AA1AF88

Function 004024B2 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 84
registryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyA.ADVAPI32(Software\WinRAR,?), ref: 004024CD
RegSetValueExA.ADVAPI32(?,?,00000000,00000003,?,?), ref: 004024E6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000003,?,?), ref: 004024F3
GetTempPathA.KERNEL32(00000104,?), ref: 0040250C
CreateDirectoryA.KERNEL32(?,00000000,00000104,?), ref: 0040252D
ExitProcess.KERNEL32(?,C0000000,00000003,00000000,00000002,00000000,00000000,?,00000000,00000104,?), ref: 00402588
CloseHandle.KERNEL32(?,?,C0000000,00000003,00000000,00000002,00000000,00000000,?,00000000,00000104,?), ref: 004025A6
DeleteFileA.KERNEL32(?,?,C0000000,00000003,00000000,00000002,00000000,00000000,?,00000000,00000104,?), ref: 004025B5

Strings

Software\WinRAR, xrefs: 004024C2

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseCreate$DeleteDirectoryExitFileHandlePathProcessTempValue
String ID: Software\WinRAR
API String ID: 2428708885-224198155
Opcode ID: b7997a29f9ee12ea2c8683bdef5b38ffdcc73321be99e554f2081b4ec90afc21
Instruction ID: 37bae476364215f7a376405172e95ff0b3e620823ab204ba3b78da35b93a11c1
Opcode Fuzzy Hash: b7997a29f9ee12ea2c8683bdef5b38ffdcc73321be99e554f2081b4ec90afc21
Instruction Fuzzy Hash: 5C216D3191020DBADF21ABE1CD46FDD7A79AB14748F104476B604B50E1E6F99B909B1C

Function 00404C68 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00404C8C

Part of subcall function 00401BCD: lstrlen.KERNEL32(?), ref: 00401BEE
Part of subcall function 00401BCD: lstrlen.KERNEL32(00000000,?), ref: 00401BF8
Part of subcall function 00401BCD: lstrcpy.KERNEL32(00000000,?), ref: 00401C0C
Part of subcall function 00401BCD: lstrcat.KERNEL32(00000000,00000000), ref: 00401C15

GetPrivateProfileStringA.KERNEL32(WS_FTP,DIR,00411805,?,00000104,?), ref: 00404CDC
GetPrivateProfileStringA.KERNEL32(WS_FTP,DEFDIR,00411805,?,00000104,?), ref: 00404D17

Strings

DIR, xrefs: 00404CD2
WS_FTP, xrefs: 00404CD7, 00404D12
DEFDIR, xrefs: 00404D0D
\Ipswitch, xrefs: 00404D63, 00404D72, 00404D81
\Ipswitch\WS_FTP, xrefs: 00404D47
\win.ini, xrefs: 00404CA4

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: PrivateProfileStringlstrlen$DirectoryWindowslstrcatlstrcpy
String ID: DEFDIR$DIR$WS_FTP$\Ipswitch$\Ipswitch\WS_FTP$\win.ini
API String ID: 2508676433-45949541
Opcode ID: b48a19c3fedec4f26597234550fce3125c583f965fd7da7918b0654d8a73ed6f
Instruction ID: 833972c600fc57ce649323aa9ebf1fa4e87c99d79a78d52b417d9e2bfeec2045
Opcode Fuzzy Hash: b48a19c3fedec4f26597234550fce3125c583f965fd7da7918b0654d8a73ed6f
Instruction Fuzzy Hash: E92125B0A8020CBADF21BAA1CD43FD93D699B48744F100577B748B51E2D6F88ED09A6D

Function 0040E5DB Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 83registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401769: LocalAlloc.KERNEL32(00000040,00402200,?,00402280,?), ref: 00401777

RegOpenKeyA.ADVAPI32(?,?,?), ref: 0040E5FE
RegEnumKeyExA.ADVAPI32(?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?,00000105), ref: 0040E632
GetPrivateProfileStringA.KERNEL32(Program,DataPath,00411805,?,00000104,00000000), ref: 0040E6B8
RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?,00000105), ref: 0040E711

Strings

Program, xrefs: 0040E6B3
DataPath, xrefs: 0040E6AE
Path, xrefs: 0040E66A
accounts.ini, xrefs: 0040E6C7
\PocoSystem.ini, xrefs: 0040E68C

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: AllocCloseEnumLocalOpenPrivateProfileString
String ID: DataPath$Path$Program$\PocoSystem.ini$accounts.ini
API String ID: 1343824468-2495907966
Opcode ID: f7f0f3633f25f2bd9f0937b0f3f18dbeb2d7bad1331dcb419371d179e8ceaddf
Instruction ID: 36dd7cfe40a76730b9bba45eaf33402ea87356010da727bd2c80388284970864
Opcode Fuzzy Hash: f7f0f3633f25f2bd9f0937b0f3f18dbeb2d7bad1331dcb419371d179e8ceaddf
Instruction Fuzzy Hash: DD31FA3190410CFADF116FA18C42FDD7AB9BF04704F1088BAB655750E1EBBA5A919B98

Function 0040601A Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 140registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,?), ref: 00406030
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 00406064
RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 00406272

Strings

Host, xrefs: 004060B4
Port, xrefs: 00406113
PthR, xrefs: 004060F0
User, xrefs: 004060D2
SSH, xrefs: 00406161

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: Host$Port$PthR$SSH$User
API String ID: 1332880857-1643752846
Opcode ID: 22d3199f6ffb7bd7c324d631388ededfce537ac4dd85ea99bb1351676a49edd8
Instruction ID: 717bec1f817c6041e82a5bb1f673203c31f40167fb263f3afb6c8f705fbd8957
Opcode Fuzzy Hash: 22d3199f6ffb7bd7c324d631388ededfce537ac4dd85ea99bb1351676a49edd8
Instruction Fuzzy Hash: 8751C531940118EADF227B51CD42BD9BBB5BF04308F10C0BAB645750B1DBBA5AA1EF88

Function 00405B69 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 121registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,?), ref: 00405B7F
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 00405BB3
RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 00405D5F

Part of subcall function 00401752: LocalFree.KERNEL32(00000000,?,004022A7,?,?,?,?,?,?), ref: 0040175E

Strings

Port, xrefs: 00405C68
UserName, xrefs: 00405C27
RemoteDir, xrefs: 00405C45
Password, xrefs: 00405BEB
HostAdrs, xrefs: 00405C09

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumFreeLocalOpen
String ID: HostAdrs$Password$Port$RemoteDir$UserName
API String ID: 3369285772-3748300950
Opcode ID: 861065ac100eef7e94bd919a254844cf1528a48578ae58a6f8f0bce791b71619
Instruction ID: bd6511a607c152044000779701187701da5593353ec7af31bd24a4650797122f
Opcode Fuzzy Hash: 861065ac100eef7e94bd919a254844cf1528a48578ae58a6f8f0bce791b71619
Instruction Fuzzy Hash: 5041A431940118BADF227B51CD42BD9BBB9FF04308F10C0BAB245750B1DBBA5A91AF98

Function 00406D5E Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,?,?), ref: 00406D71
RegEnumKeyExA.ADVAPI32(?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 00406DA5
RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 00406F37

Strings

UserName, xrefs: 00406E2E
Server, xrefs: 00406E13
Directory, xrefs: 00406E49
Password, xrefs: 00406DDD
_Password, xrefs: 00406DF8

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: Directory$Password$Server$UserName$_Password
API String ID: 1332880857-3317168126
Opcode ID: 0295d48f9159583e3bb3b4c81249b031f90fd7620fc95874c7d8aa04f99b4e09
Instruction ID: 16d1b833b2ee5968848fc559eb8c09407504fd4541dfa60c1da0701f2eff17c4
Opcode Fuzzy Hash: 0295d48f9159583e3bb3b4c81249b031f90fd7620fc95874c7d8aa04f99b4e09
Instruction Fuzzy Hash: 6341953194011CBADF226F51CD42BDDBBB5BF04304F10C1BAB559750B2DBBA5AA1AF88

Function 0040D5DC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,?,?), ref: 0040D5EF
RegEnumKeyExA.ADVAPI32(?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 0040D623
RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 0040D7B7

Strings

UserName, xrefs: 0040D676
HostName, xrefs: 0040D65B
TerminalType, xrefs: 0040D6CC
Password, xrefs: 0040D691
PortNumber, xrefs: 0040D6B1

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: HostName$Password$PortNumber$TerminalType$UserName
API String ID: 1332880857-1017491782
Opcode ID: 36fac6972d13d9aaf5a0a37310bf3e32aab8aaddad991833400995bc47fd96b9
Instruction ID: 80c3a7e6e8e16172fa092274a63f5f0f4b87c6c355c6ed336365e5d713e553db
Opcode Fuzzy Hash: 36fac6972d13d9aaf5a0a37310bf3e32aab8aaddad991833400995bc47fd96b9
Instruction Fuzzy Hash: 40419531840118FADF226F91CC42BDDBBB5BF04308F10C4BAB649751B1DB7A5AA59F88

Function 00406F89 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,?,?), ref: 00406F9C
RegEnumKeyExA.ADVAPI32(?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 00406FD0
RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 00407162

Strings

FtpDirectory, xrefs: 00407074
_FtpPassword, xrefs: 00407023
FtpPassword, xrefs: 00407008
FtpUserName, xrefs: 00407059
FtpServer, xrefs: 0040703E

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: FtpDirectory$FtpPassword$FtpServer$FtpUserName$_FtpPassword
API String ID: 1332880857-980612798
Opcode ID: 675a1423b11df55a91f59a4ac948b29fe10135cf848136257ad25863e74e94f9
Instruction ID: fac69ff356c5d9a3a700d045b1112cda43426525da53c38b63ceafff8f4ab98b
Opcode Fuzzy Hash: 675a1423b11df55a91f59a4ac948b29fe10135cf848136257ad25863e74e94f9
Instruction Fuzzy Hash: B541B63194011CBADF226F51CD42BDDBBB5BF04304F10C0BAB659791B1DBBA5AA19F88

Function 00405E01 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 112registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,?), ref: 00405E17
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 00405E4B
RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 00405FE0

Strings

HostDirName, xrefs: 00405EFB
Port, xrefs: 00405EBF
HostName, xrefs: 00405EA1
Username, xrefs: 00405EDD
Password, xrefs: 00405E83

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: HostDirName$HostName$Password$Port$Username
API String ID: 1332880857-791697221
Opcode ID: 5f429ff3d63b552880f898da56513a68410768927777eac0ef42e1b95d242391
Instruction ID: 02d2e0d06eb6aa5cd977bda184cad4249618897674006919e1422700d120f387
Opcode Fuzzy Hash: 5f429ff3d63b552880f898da56513a68410768927777eac0ef42e1b95d242391
Instruction Fuzzy Hash: A8418531940118BADF227B51DD42BDDBBB5FF04304F10C0BAB645750B1DBBA5AA1AF98

Function 0040D1A2 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 108registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,?), ref: 0040D1B8
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 0040D1EC
RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 0040D36F

Strings

Pass, xrefs: 0040D260
Port, xrefs: 0040D27E
Host, xrefs: 0040D224
User, xrefs: 0040D242
Remote Dir, xrefs: 0040D29C

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: Host$Pass$Port$Remote Dir$User
API String ID: 1332880857-1775099961
Opcode ID: 72010a422a528b3a6febdf38cc13342291fb876f8aca6c746118a020dd241374
Instruction ID: 16c70e4eb59eb3fe7fd28d31a3833132b033dbea7dcbbf5d53e6c61d8458b25c
Opcode Fuzzy Hash: 72010a422a528b3a6febdf38cc13342291fb876f8aca6c746118a020dd241374
Instruction Fuzzy Hash: DC41D771840118BADF227F91CD42BDCBBB5BF04704F10C0BAB645750B2DB7A5A91AF98

Function 0040C405 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 101COMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI(007200D8,BlazeFtp), ref: 0040C42C

Part of subcall function 00402200: lstrlen.KERNEL32(?), ref: 00402214
Part of subcall function 00402200: StrStrIA.SHLWAPI(00000000,.exe,?), ref: 00402233
Part of subcall function 00402200: StrRChrIA.SHLWAPI(00000000,00000000,0000005C,00000000,.exe,?), ref: 00402245
Part of subcall function 00402200: lstrlen.KERNEL32(00000000,00000000,00000000,0000005C,00000000,.exe,?), ref: 00402257

Part of subcall function 00401752: LocalFree.KERNEL32(00000000,?,004022A7,?,?,?,?,?,?), ref: 0040175E

Strings

LastPort, xrefs: 0040C4D6
BlazeFtp, xrefs: 0040C426
LastPassword, xrefs: 0040C486
\BlazeFtp, xrefs: 0040C477
LastUser, xrefs: 0040C4BA
site.dat, xrefs: 0040C447, 0040C472
Software\FlashPeak\BlazeFtp\Settings, xrefs: 0040C48B, 0040C4A5, 0040C4BF, 0040C4DB
LastAddress, xrefs: 0040C4A0

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: lstrlen$FreeLocal
String ID: BlazeFtp$LastAddress$LastPassword$LastPort$LastUser$Software\FlashPeak\BlazeFtp\Settings$\BlazeFtp$site.dat
API String ID: 1884169789-2976447346
Opcode ID: 45f9370da21ecbccc8b1bb17dd46baba8a71987c16784ecbe0b6d5142734595e
Instruction ID: 087c8f14cc38ebf4340fa4c74bc8456b090ac4174222f55b5626d9778e4d167b
Opcode Fuzzy Hash: 45f9370da21ecbccc8b1bb17dd46baba8a71987c16784ecbe0b6d5142734595e
Instruction Fuzzy Hash: 4531F730940109BADF126FA1DC42BAE7F72AB40B45F10813AB615351F2D7B95B90EB8C

Function 00404FE0 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 69COMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI(007200D8,CUTEFTP), ref: 00405007

Part of subcall function 00402200: lstrlen.KERNEL32(?), ref: 00402214
Part of subcall function 00402200: StrStrIA.SHLWAPI(00000000,.exe,?), ref: 00402233
Part of subcall function 00402200: StrRChrIA.SHLWAPI(00000000,00000000,0000005C,00000000,.exe,?), ref: 00402245
Part of subcall function 00402200: lstrlen.KERNEL32(00000000,00000000,00000000,0000005C,00000000,.exe,?), ref: 00402257

Part of subcall function 00401752: LocalFree.KERNEL32(00000000,?,004022A7,?,?,?,?,?,?), ref: 0040175E

Strings

CUTEFTP, xrefs: 00405001
Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar, xrefs: 00405071
Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar, xrefs: 004050A5
Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar, xrefs: 00405098
Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar, xrefs: 0040508B
Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar, xrefs: 00405064
\sm.dat, xrefs: 0040501B
Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar, xrefs: 0040507E

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: lstrlen$FreeLocal
String ID: CUTEFTP$Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar$Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar$Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar$Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar$Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar$Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar$\sm.dat
API String ID: 1884169789-2738976122
Opcode ID: 53a5ffd72eef3946d52d7a2c873d6d4d47f5f81c126ab374a59c1b1bfb5f9826
Instruction ID: 40326283f0e2aaf7953628d4f5848c5de1a0b9c4e64ebf3f828c0269d9f17f80
Opcode Fuzzy Hash: 53a5ffd72eef3946d52d7a2c873d6d4d47f5f81c126ab374a59c1b1bfb5f9826
Instruction Fuzzy Hash: AB1121B0640109B9DF21BF21CD02FDE3E65AF51784F104136BA44B51F3C7BD8AA1969C

Function 00406931 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 121registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,?), ref: 00406947
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 0040697B
RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 00406B1C

Part of subcall function 00401752: LocalFree.KERNEL32(00000000,?,004022A7,?,?,?,?,?,?), ref: 0040175E

Strings

Username, xrefs: 004069F4
Hostname, xrefs: 004069D6
Password, xrefs: 004069B8
Port, xrefs: 00406A17

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumFreeLocalOpen
String ID: Hostname$Password$Port$Username
API String ID: 3369285772-1811172798
Opcode ID: 7748ef1c9e17dcbd72711a2d7625c610005a5d9d9387b89186d8fef29979e095
Instruction ID: 24717ae2ce83b4fee808f0103274e04dd0bff139fda315af897242a983001c14
Opcode Fuzzy Hash: 7748ef1c9e17dcbd72711a2d7625c610005a5d9d9387b89186d8fef29979e095
Instruction Fuzzy Hash: B341C87194011CEADF21BB51CC42BD9BAB9BF04308F10C0BAB545750B1DFBA5AA19F98

Function 00406738 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 110registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,?), ref: 0040674E
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 00406782
RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 004068F7

Part of subcall function 00401752: LocalFree.KERNEL32(00000000,?,004022A7,?,?,?,?,?,?), ref: 0040175E

Strings

Password, xrefs: 004067BA
Server, xrefs: 004067D8
FtpPort, xrefs: 00406819
Username, xrefs: 004067F6

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumFreeLocalOpen
String ID: FtpPort$Password$Server$Username
API String ID: 3369285772-1828875246
Opcode ID: 33ababc615020c475aea93dc55798473f16b2b39c4eed30d71edd941c412992a
Instruction ID: 2d861f8c944312f088572d5a7307ac687774c4b6fa6ec605e7997a0d99139e7a
Opcode Fuzzy Hash: 33ababc615020c475aea93dc55798473f16b2b39c4eed30d71edd941c412992a
Instruction Fuzzy Hash: 3041D931940118FADF217B51CD42BD97BB9BF04308F10C0BAB545750B1DBBA5AA5AF98

Function 0040DE19 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 97registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,?,?), ref: 0040DE29
RegCloseKey.ADVAPI32(?,?,?,00000000,?,?,?,?,?), ref: 0040DF59

Part of subcall function 00403FF9: CryptUnprotectData.CRYPT32(00000000,00000000,00000000,00000000,00000000,00000001,?), ref: 00404045
Part of subcall function 00403FF9: LocalFree.KERNEL32(00000000), ref: 00404079

Part of subcall function 00401548: lstrlen.KERNEL32(00000000), ref: 00401554

Strings

Site, xrefs: 0040DE38
UserID, xrefs: 0040DE4D
xflags, xrefs: 0040DE64
Folder, xrefs: 0040DE8E
Port, xrefs: 0040DE79

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseCryptDataFreeLocalOpenUnprotectlstrlen
String ID: Folder$Port$Site$UserID$xflags
API String ID: 2167297517-269738940
Opcode ID: b197340e990e52b368227ab337fb88699f86a103d108e5365677279b24fd79d5
Instruction ID: a6a90b714e26ee6588c0913544ebb450cdb080e323798d6688fbffd92cab19fa
Opcode Fuzzy Hash: b197340e990e52b368227ab337fb88699f86a103d108e5365677279b24fd79d5
Instruction Fuzzy Hash: C5319335C5010ABBDF12AF91CC42AEEBB72BF04349F10843AB611751F1D77A9A64EB48

Function 004074AA Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,?,?), ref: 004074BD
RegEnumKeyExA.ADVAPI32(?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 004074F1
RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 0040760C

Strings

sites.dat, xrefs: 0040756B, 004075A4
InstallPath, xrefs: 00407529
DataDir, xrefs: 00407544
sites.ini, xrefs: 00407583, 004075BC

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: DataDir$InstallPath$sites.dat$sites.ini
API String ID: 1332880857-3870687875
Opcode ID: 7898ede5be31474b678268efb6e6f80c155cac00ced80efcf6e420b7494e70d9
Instruction ID: d3284ad3f34496e62fd12d7fa9e0dcff96666478f7bf7f6fef37d7e2cb8aa850
Opcode Fuzzy Hash: 7898ede5be31474b678268efb6e6f80c155cac00ced80efcf6e420b7494e70d9
Instruction Fuzzy Hash: 5331F83190011CBADF21AF51CD02FDD7ABABF04304F10C4B6B545750A1DBBA6BA19F99

Function 0040F401 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 0040F42F

Part of subcall function 0040981E: StrStrIA.SHLWAPI(?,?), ref: 0040982A
Part of subcall function 0040981E: RegOpenKeyA.ADVAPI32(?,?,?), ref: 004098A1
Part of subcall function 0040981E: RegEnumKeyExA.ADVAPI32(?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?,00000800,?,?), ref: 004098CD
Part of subcall function 0040981E: RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?,00000800,?,?), ref: 00409915

SetCurrentDirectoryA.KERNEL32(?,?), ref: 0040F474
GetCurrentDirectoryA.KERNEL32(00000104,?,?,?), ref: 0040F48F
SetCurrentDirectoryA.KERNEL32(?,?,?,?), ref: 0040F4D4

Strings

Software\Mozilla, xrefs: 0040F43E, 0040F45B, 0040F49E, 0040F4BB
Thunderbird, xrefs: 0040F439, 0040F456, 0040F499, 0040F4B6
\Thunderbird, xrefs: 0040F434, 0040F451, 0040F494, 0040F4B1

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CurrentDirectory$CloseEnumOpen
String ID: Software\Mozilla$Thunderbird$\Thunderbird
API String ID: 3062143572-138716004
Opcode ID: fb50987f158ec55cfe2bb98806428d2a930dfc83a1c3585cb17d9350d07b801a
Instruction ID: 149315b3b7d40ce8fe94d34389e19c2d4a991ddf4f61bed643bfa2bff0e59c54
Opcode Fuzzy Hash: fb50987f158ec55cfe2bb98806428d2a930dfc83a1c3585cb17d9350d07b801a
Instruction Fuzzy Hash: A611D431240219BADB21BF52CD42FC93A69AB48B04F50C07AB704751E3DFF98ED09A98

Function 00407661 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 100stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(007200D8,unleap.exe), ref: 00407693
lstrlen.KERNEL32(unleap.exe,00000001,007200D8,unleap.exe), ref: 004076AC

Part of subcall function 00402200: lstrlen.KERNEL32(?), ref: 00402214
Part of subcall function 00402200: StrStrIA.SHLWAPI(00000000,.exe,?), ref: 00402233
Part of subcall function 00402200: StrRChrIA.SHLWAPI(00000000,00000000,0000005C,00000000,.exe,?), ref: 00402245
Part of subcall function 00402200: lstrlen.KERNEL32(00000000,00000000,00000000,0000005C,00000000,.exe,?), ref: 00402257

Part of subcall function 00401752: LocalFree.KERNEL32(00000000,?,004022A7,?,?,?,?,?,?), ref: 0040175E

StrStrIA.SHLWAPI(007203F8,leapftp,007200D8,unleap.exe), ref: 004076F0

Strings

leapftp, xrefs: 004076EA
sites.dat, xrefs: 004076C1, 00407706
sites.ini, xrefs: 004076D5, 0040771A
SOFTWARE\LeapWare, xrefs: 00407766, 00407779
unleap.exe, xrefs: 0040768D, 004076A7

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: lstrlen$FreeLocal
String ID: SOFTWARE\LeapWare$leapftp$sites.dat$sites.ini$unleap.exe
API String ID: 1884169789-1497043051
Opcode ID: af4d8a99ae7d6717864c20f85514df29d3cffccb4e66039880575eb1ac25d03b
Instruction ID: ca438b8d423bcd58eb69d4cbe9981110522e53291ca9e45b99f12488e8eba69f
Opcode Fuzzy Hash: af4d8a99ae7d6717864c20f85514df29d3cffccb4e66039880575eb1ac25d03b
Instruction Fuzzy Hash: 2121C870A441047DEB213B31CD02FAE3E1ADF84794F244437B912B61E3D7BD6AA2929D

Function 0040EB4E Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 00401752: LocalFree.KERNEL32(00000000,?,004022A7,?,?,?,?,?,?), ref: 0040175E

wsprintfA.USER32 ref: 0040EC23

Strings

Count, xrefs: 0040EBE2
Dir #%d, xrefs: 0040EC1A
Software\RIT\The Bat!\Users depot, xrefs: 0040EBB7, 0040EBE7, 0040EC33
Software\RIT\The Bat!, xrefs: 0040EB5B, 0040EB89
Default, xrefs: 0040EBB2
ProgramDir, xrefs: 0040EB84
Working Directory, xrefs: 0040EB56

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: FreeLocalwsprintf
String ID: Count$Default$Dir #%d$ProgramDir$Software\RIT\The Bat!$Software\RIT\The Bat!\Users depot$Working Directory
API String ID: 988369812-1921698578
Opcode ID: 111e2f18cc080e312094e3f199f6637e13ef9141b0adfb92f192eb5c2020bf9f
Instruction ID: b8460b7012a66b18e4ab8811a7bc871307c8c31403b4ecf2b79765d56f7371ef
Opcode Fuzzy Hash: 111e2f18cc080e312094e3f199f6637e13ef9141b0adfb92f192eb5c2020bf9f
Instruction Fuzzy Hash: C931E131A04108FADF11AF91DD42ADE7B75AB04714F204877F511751F1D7BA9B60AB48

Function 0040486E Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 00401769: LocalAlloc.KERNEL32(00000040,00402200,?,00402280,?), ref: 00401777

GetWindowsDirectoryA.KERNEL32(?,00000104,00000105), ref: 00404898

Strings

\GHISLER, xrefs: 004048D8, 004048F7, 00404916
Software\Ghisler\Total Commander, xrefs: 00404982, 004049A2, 00404A22, 00404A41
Software\Ghisler\Windows Commander, xrefs: 00404931, 00404951, 004049D3, 004049F2
FtpIniName, xrefs: 0040494C, 0040499D, 004049ED, 00404A3C
InstallDir, xrefs: 0040492C, 0040497D, 004049CE, 00404A1D

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: AllocDirectoryLocalWindows
String ID: FtpIniName$InstallDir$Software\Ghisler\Total Commander$Software\Ghisler\Windows Commander$\GHISLER
API String ID: 3186838798-3636168975
Opcode ID: ffea5e168f270e24eb25b05d6cc74e16a969fd76c9c952f636d6df37aa190e76
Instruction ID: ff12591b31ff326238e2f8ff1c408cb403752ed0395ffe955c3525f53abc4278
Opcode Fuzzy Hash: ffea5e168f270e24eb25b05d6cc74e16a969fd76c9c952f636d6df37aa190e76
Instruction Fuzzy Hash: 2F41F0B0A80104BAEF213B62CD43F9D7E65EB55748F10853BB700B90F2DBBD99A0965C

Function 00404538 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,?), ref: 0040454E
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 00404582
RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 004046A9

Strings

Password, xrefs: 004045BA
HostName, xrefs: 004045D8
User, xrefs: 004045F6

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: HostName$Password$User
API String ID: 1332880857-1253078594
Opcode ID: c3b991bb0fe04561cae893e15422e5c563704640a4d9e7a21aec12efcae835ee
Instruction ID: dbef1a4a2983c09e8c68882a36fea80571c83e5172a5b0cd2e157321f814a4e2
Opcode Fuzzy Hash: c3b991bb0fe04561cae893e15422e5c563704640a4d9e7a21aec12efcae835ee
Instruction Fuzzy Hash: E331A77194011CBADF227B51CC42BDD7BB9BF44308F10C4BAB645750B1DBBA5A91AF88

Function 004089EF Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,?,?), ref: 00408A02
RegEnumKeyExA.ADVAPI32(?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 00408A36
RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 00408B28

Strings

wiseftp.ini, xrefs: 00408AC6
wiseftpsrvs.ini, xrefs: 00408AAE
wiseftpsrvs.bin, xrefs: 00408ADE

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: wiseftp.ini$wiseftpsrvs.bin$wiseftpsrvs.ini
API String ID: 1332880857-3184955129
Opcode ID: d5dd535362712fa5a46c74c6496d1ec087d2de753653d067e406bb6c2482dc77
Instruction ID: a70945101c84c7ac796ce7a614a6bd97096326bed53b746d6beeb2bdcda40b4a
Opcode Fuzzy Hash: d5dd535362712fa5a46c74c6496d1ec087d2de753653d067e406bb6c2482dc77
Instruction Fuzzy Hash: 9E31F83190010DBADF216F61CD42FDD7ABABF04344F10C4BAB554B50A2DFB95A91AF98

Function 004099AD Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00409A0A
SetCurrentDirectoryA.KERNEL32(?,?), ref: 00409A4F

Part of subcall function 00401C21: lstrlen.KERNEL32(?), ref: 00401C42
Part of subcall function 00401C21: lstrlen.KERNEL32(00000000,?), ref: 00401C4C
Part of subcall function 00401C21: lstrcpy.KERNEL32(00000000,?), ref: 00401C60
Part of subcall function 00401C21: lstrcat.KERNEL32(00000000,00000000), ref: 00401C69

Part of subcall function 00401752: LocalFree.KERNEL32(00000000,?,004022A7,?,?,?,?,?,?), ref: 0040175E

Strings

Firefox, xrefs: 00409A14, 00409A31
fireFTPsites.dat, xrefs: 004099E1
\Mozilla\Firefox\, xrefs: 004099D0, 00409A0F, 00409A2C
Software\Mozilla, xrefs: 00409A19, 00409A36

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CurrentDirectorylstrlen$FreeLocallstrcatlstrcpy
String ID: Firefox$Software\Mozilla$\Mozilla\Firefox\$fireFTPsites.dat
API String ID: 3007406096-624000163
Opcode ID: 077474363eb1cb21634e0b13a7f884a159e08b407b3dd271821e8b6df93273d4
Instruction ID: 067d11940ba8822908139912771a022fcba50eecc684ffed189774b448b63df1
Opcode Fuzzy Hash: 077474363eb1cb21634e0b13a7f884a159e08b407b3dd271821e8b6df93273d4
Instruction Fuzzy Hash: A4015E70640208B9DB217F61CC47FDA3EA89B08B49F10807ABA04751E7DBB9CB909A5C

Function 0040981E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85registryCOMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI(?,?), ref: 0040982A
RegOpenKeyA.ADVAPI32(?,?,?), ref: 004098A1
RegEnumKeyExA.ADVAPI32(?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?,00000800,?,?), ref: 004098CD
RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?,00000800,?,?), ref: 00409915

Part of subcall function 00402200: lstrlen.KERNEL32(?), ref: 00402214
Part of subcall function 00402200: StrStrIA.SHLWAPI(00000000,.exe,?), ref: 00402233
Part of subcall function 00402200: StrRChrIA.SHLWAPI(00000000,00000000,0000005C,00000000,.exe,?), ref: 00402245
Part of subcall function 00402200: lstrlen.KERNEL32(00000000,00000000,00000000,0000005C,00000000,.exe,?), ref: 00402257

Part of subcall function 00401C21: lstrlen.KERNEL32(?), ref: 00401C42
Part of subcall function 00401C21: lstrlen.KERNEL32(00000000,?), ref: 00401C4C
Part of subcall function 00401C21: lstrcpy.KERNEL32(00000000,?), ref: 00401C60
Part of subcall function 00401C21: lstrcat.KERNEL32(00000000,00000000), ref: 00401C69

Part of subcall function 00401752: LocalFree.KERNEL32(00000000,?,004022A7,?,?,?,?,?,?), ref: 0040175E

Strings

PathToExe, xrefs: 00409835

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: lstrlen$CloseEnumFreeLocalOpenlstrcatlstrcpy
String ID: PathToExe
API String ID: 3012581338-1982016430
Opcode ID: 6c3ee56b1af1d609d7f11486cfbfb07c182c8bca4d67ddacbaab2672a77783be
Instruction ID: 4240f0cea3594d7691bdb638aaead59f9fffd590682c6645e5e2c10b6cb559ff
Opcode Fuzzy Hash: 6c3ee56b1af1d609d7f11486cfbfb07c182c8bca4d67ddacbaab2672a77783be
Instruction Fuzzy Hash: 27310F71910109BADF017FA1CD02EEE7A75FF05344F10443ABA11B51F2DBBA8E60AB69

Function 004025CC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 00402602
GetHGlobalFromStream.OLE32(?,?,?,00000000,?,00000000,?,00000104,?), ref: 00402684
GlobalLock.KERNEL32(?), ref: 00402690
GlobalUnlock.KERNEL32(?), ref: 004026B2

Part of subcall function 00401BCD: lstrlen.KERNEL32(?), ref: 00401BEE
Part of subcall function 00401BCD: lstrlen.KERNEL32(00000000,?), ref: 00401BF8
Part of subcall function 00401BCD: lstrcpy.KERNEL32(00000000,?), ref: 00401C0C
Part of subcall function 00401BCD: lstrcat.KERNEL32(00000000,00000000), ref: 00401C15

Part of subcall function 00401C21: lstrlen.KERNEL32(?), ref: 00401C42
Part of subcall function 00401C21: lstrlen.KERNEL32(00000000,?), ref: 00401C4C
Part of subcall function 00401C21: lstrcpy.KERNEL32(00000000,?), ref: 00401C60
Part of subcall function 00401C21: lstrcat.KERNEL32(00000000,00000000), ref: 00401C69

Strings

Software\WinRAR, xrefs: 004025DC

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: lstrlen$Global$lstrcatlstrcpy$FromLockPathStreamTempUnlock
String ID: Software\WinRAR
API String ID: 2536169780-224198155
Opcode ID: 1187d3a3ac6e2532d8f5cc01240ee3561c668e13f9ba7699e1051f0c0d89f365
Instruction ID: 2abfcd972a9822b01129ef8867a75c560604cbfc2d7908670ee80c51707ce61e
Opcode Fuzzy Hash: 1187d3a3ac6e2532d8f5cc01240ee3561c668e13f9ba7699e1051f0c0d89f365
Instruction Fuzzy Hash: C3212C7190010DBADF11BBE1CD46DDE7B79AB04348F104877B600F10F2EBBA9A949B68

Function 0040442A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,?), ref: 00404440
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,?,00000000,00000000,?,?), ref: 00404479
StrStrIA.SHLWAPI(?,Line), ref: 004044AA
RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,00000001,00000000,00000000,?,Line), ref: 0040452F

Strings

Line, xrefs: 0040449E

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpenValue
String ID: Line
API String ID: 4012628704-1898322888
Opcode ID: 9dc5b1b612268df97d841b8a8d495a88f1f2b345677e12d1725af5aa0e4e1e7d
Instruction ID: f91f4e1feec9d5ad625a7b2a9fab21848115cfa1c53827807270e1285b900478
Opcode Fuzzy Hash: 9dc5b1b612268df97d841b8a8d495a88f1f2b345677e12d1725af5aa0e4e1e7d
Instruction Fuzzy Hash: C421197180001CBADF21AB91CD41BDDBBB9BF41304F10C0B7B644B51A1DBBA9A95EF99

Function 0040DF62 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,?,?), ref: 0040DF75
RegEnumValueA.ADVAPI32(?,00000000,?,000007FF,00000000,?,00000000,00000000,?,?,?), ref: 0040DFAE
StrStrIA.SHLWAPI(?,.wjf), ref: 0040DFF5
RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,?,00000000,00000000,?,?,?), ref: 0040E022

Strings

.wjf, xrefs: 0040DFEA

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpenValue
String ID: .wjf
API String ID: 4012628704-198459012
Opcode ID: 4f05375757efe4b6d3688668ce3f3ea3473d9cca9a06c75d9ea5d1bdf91f0b83
Instruction ID: 43279a2a018755c5e1060965d219f417e113db824b34a168a00d580839c9dc7a
Opcode Fuzzy Hash: 4f05375757efe4b6d3688668ce3f3ea3473d9cca9a06c75d9ea5d1bdf91f0b83
Instruction Fuzzy Hash: 5C11263191001DBACF11AF91CC01AEEBBB8BF00304F1084B6A545B51A1DBBA9B95AF99

Function 00404189 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004025CC: GetTempPathA.KERNEL32(00000104,?), ref: 00402602
Part of subcall function 004025CC: GetHGlobalFromStream.OLE32(?,?,?,00000000,?,00000000,?,00000104,?), ref: 00402684
Part of subcall function 004025CC: GlobalLock.KERNEL32(?), ref: 00402690
Part of subcall function 004025CC: GlobalUnlock.KERNEL32(?), ref: 004026B2

CoCreateGuid.OLE32(?,00000000), ref: 004041AC
wsprintfA.USER32 ref: 004041F3
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004041FF

Strings

HWID, xrefs: 00404193, 00404209
{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}, xrefs: 004041EA

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: Global$CreateFromGuidLockPathStreamTempUnlocklstrlenwsprintf
String ID: HWID${%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}
API String ID: 1852535927-1100116640
Opcode ID: 840eb3ad66c41fe263eb2eafe22b724e0cc44c758affdf0c72c0414b0100f10f
Instruction ID: c4e1b62278512b928dcdde7341008605bb0b3f4c3d7ab357c6a060e116bdcc76
Opcode Fuzzy Hash: 840eb3ad66c41fe263eb2eafe22b724e0cc44c758affdf0c72c0414b0100f10f
Instruction Fuzzy Hash: 07111BA69041A97DDB61E3F64C05DFFBAFC590D205B1401ABBA90E20C2E67DD7409B38

Function 00409926 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00409954

Part of subcall function 0040981E: StrStrIA.SHLWAPI(?,?), ref: 0040982A
Part of subcall function 0040981E: RegOpenKeyA.ADVAPI32(?,?,?), ref: 004098A1
Part of subcall function 0040981E: RegEnumKeyExA.ADVAPI32(?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?,00000800,?,?), ref: 004098CD
Part of subcall function 0040981E: RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?,00000800,?,?), ref: 00409915

SetCurrentDirectoryA.KERNEL32(?,?), ref: 00409999

Strings

Firefox, xrefs: 0040995E, 0040997B
\Mozilla\Firefox\, xrefs: 00409959, 00409976
Software\Mozilla, xrefs: 00409963, 00409980

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CurrentDirectory$CloseEnumOpen
String ID: Firefox$Software\Mozilla$\Mozilla\Firefox\
API String ID: 3062143572-2631691096
Opcode ID: b864d701e8e15c7e68fa2287fc1162954e377e81177388ab5f0c84afc04fd57d
Instruction ID: 7b62cf37f070a4fb375d2b5b1302e7b5f4762ac1398b9eae7c482788379758ad
Opcode Fuzzy Hash: b864d701e8e15c7e68fa2287fc1162954e377e81177388ab5f0c84afc04fd57d
Instruction Fuzzy Hash: 1CF03031640208BADB21BF51DD43FC97EA9AB08B48F508066B604751E3DBF99BD09B4C

Function 00409A63 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00409A91

Part of subcall function 0040981E: StrStrIA.SHLWAPI(?,?), ref: 0040982A
Part of subcall function 0040981E: RegOpenKeyA.ADVAPI32(?,?,?), ref: 004098A1
Part of subcall function 0040981E: RegEnumKeyExA.ADVAPI32(?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?,00000800,?,?), ref: 004098CD
Part of subcall function 0040981E: RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?,00000800,?,?), ref: 00409915

SetCurrentDirectoryA.KERNEL32(?,?), ref: 00409AD6

Strings

SeaMonkey, xrefs: 00409A9B, 00409AB8
Software\Mozilla, xrefs: 00409AA0, 00409ABD
\Mozilla\SeaMonkey\, xrefs: 00409A96, 00409AB3

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CurrentDirectory$CloseEnumOpen
String ID: SeaMonkey$Software\Mozilla$\Mozilla\SeaMonkey\
API String ID: 3062143572-164276155
Opcode ID: c03f42ead4cdf643d7099342c91f6daac96ae31a6cfeadbc48a658cf60dfd6c9
Instruction ID: c662e76dbef64a068a92444c77d56f754835518ac613da1a147b232d30860ea1
Opcode Fuzzy Hash: c03f42ead4cdf643d7099342c91f6daac96ae31a6cfeadbc48a658cf60dfd6c9
Instruction Fuzzy Hash: 84F09670640208BADB20BF51CC03FC93EB8AB08705F508066B604751E7DBF99BD09B4C

Function 00409AEA Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00409B18

Part of subcall function 0040981E: StrStrIA.SHLWAPI(?,?), ref: 0040982A
Part of subcall function 0040981E: RegOpenKeyA.ADVAPI32(?,?,?), ref: 004098A1
Part of subcall function 0040981E: RegEnumKeyExA.ADVAPI32(?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?,00000800,?,?), ref: 004098CD
Part of subcall function 0040981E: RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?,00000800,?,?), ref: 00409915

SetCurrentDirectoryA.KERNEL32(?,?), ref: 00409B5D

Strings

\Flock\Browser\, xrefs: 00409B1D, 00409B3A
Software\Mozilla, xrefs: 00409B27, 00409B44
Flock, xrefs: 00409B22, 00409B3F

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CurrentDirectory$CloseEnumOpen
String ID: Flock$Software\Mozilla$\Flock\Browser\
API String ID: 3062143572-1276807325
Opcode ID: 39e9080a4629d2c137f4b2ce5545a2bb9fff7d0a9044e6c14ccc3c37974c2919
Instruction ID: a515aee1485dadb476b2cec9ed0f6dd48552a6037751f694a694d3432716905f
Opcode Fuzzy Hash: 39e9080a4629d2c137f4b2ce5545a2bb9fff7d0a9044e6c14ccc3c37974c2919
Instruction Fuzzy Hash: 9AF03C31540208B9DB21BF51CD43FC97EA55B08709F508066B644751E3DBF99FD09B4C

Function 00409B71 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00409B9F

Part of subcall function 0040981E: StrStrIA.SHLWAPI(?,?), ref: 0040982A
Part of subcall function 0040981E: RegOpenKeyA.ADVAPI32(?,?,?), ref: 004098A1
Part of subcall function 0040981E: RegEnumKeyExA.ADVAPI32(?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?,00000800,?,?), ref: 004098CD
Part of subcall function 0040981E: RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?,00000800,?,?), ref: 00409915

SetCurrentDirectoryA.KERNEL32(?,?), ref: 00409BE4

Strings

Mozilla, xrefs: 00409BA9, 00409BC6
Software\Mozilla, xrefs: 00409BAE, 00409BCB
\Mozilla\Profiles\, xrefs: 00409BA4, 00409BC1

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CurrentDirectory$CloseEnumOpen
String ID: Mozilla$Software\Mozilla$\Mozilla\Profiles\
API String ID: 3062143572-2716603926
Opcode ID: 35396ce86b8c1788ae7f3e08cc35d1e1cac5d3709b2988d68ad3a82d525ea0fd
Instruction ID: f2f27d82559fd93f4aef7c5dd116634fbea4d9850910639050c9cfc33e221ced
Opcode Fuzzy Hash: 35396ce86b8c1788ae7f3e08cc35d1e1cac5d3709b2988d68ad3a82d525ea0fd
Instruction Fuzzy Hash: A0F0FF31640208BADB21BF61CD46FC97EA99B08709F508066B708751E3DBB99AD09B48

Function 0040C63B Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 68COMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI(007200D8,3D-FTP), ref: 0040C662

Part of subcall function 00402200: lstrlen.KERNEL32(?), ref: 00402214
Part of subcall function 00402200: StrStrIA.SHLWAPI(00000000,.exe,?), ref: 00402233
Part of subcall function 00402200: StrRChrIA.SHLWAPI(00000000,00000000,0000005C,00000000,.exe,?), ref: 00402245
Part of subcall function 00402200: lstrlen.KERNEL32(00000000,00000000,00000000,0000005C,00000000,.exe,?), ref: 00402257

Part of subcall function 00401752: LocalFree.KERNEL32(00000000,?,004022A7,?,?,?,?,?,?), ref: 0040175E

Strings

sites.ini, xrefs: 0040C67B, 0040C6B8, 0040C6E7
\3D-FTP, xrefs: 0040C6A7
3D-FTP, xrefs: 0040C65C
\SiteDesigner, xrefs: 0040C6D6

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: lstrlen$FreeLocal
String ID: 3D-FTP$\3D-FTP$\SiteDesigner$sites.ini
API String ID: 1884169789-4074339522
Opcode ID: ffa0572995a0a9c20b75555718e68e314bfe6d377330d184481ef0f8697a6f48
Instruction ID: 05781279a1ca6ad0879fa58fbbf1fa8e39e2ddecbbd928bb128e0cd783bf3fcc
Opcode Fuzzy Hash: ffa0572995a0a9c20b75555718e68e314bfe6d377330d184481ef0f8697a6f48
Instruction Fuzzy Hash: 29118A70A40106B9EB213B758D43F6E6D5E9B40B44F140A3BB905B61F3DABEDF81926C

Function 0040AAB9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,?), ref: 0040AACF
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 0040AB03
RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 0040ABEB

Part of subcall function 0040A820: wsprintfA.USER32 ref: 0040A88C
Part of subcall function 0040A820: wsprintfA.USER32 ref: 0040A89F
Part of subcall function 0040A820: wsprintfA.USER32 ref: 0040A8B2
Part of subcall function 0040A820: wsprintfA.USER32 ref: 0040A8C5
Part of subcall function 0040A820: wsprintfA.USER32 ref: 0040A8D8
Part of subcall function 0040A820: wsprintfA.USER32 ref: 0040A8EB
Part of subcall function 0040A820: wsprintfA.USER32 ref: 0040A8FE

Strings

SiteServers, xrefs: 0040AB3D

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: wsprintf$CloseEnumOpen
String ID: SiteServers
API String ID: 1693054222-2402683488
Opcode ID: 842825de6b12b5884e4bf6c3bbd2820ca561ba5566c8314c0948b6f73f529da8
Instruction ID: ed54c4af48630386b875223b5aacfa6e9f83f9959f85fd59627ed8d9c20c5b6f
Opcode Fuzzy Hash: 842825de6b12b5884e4bf6c3bbd2820ca561ba5566c8314c0948b6f73f529da8
Instruction Fuzzy Hash: 2D310D3190021CEADF21AB91CD02BDDBBB9BF04304F14C0B6E645751A1DB795B92DF9A

Function 00408900 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,?,?), ref: 00408913
RegEnumKeyExA.ADVAPI32(?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 00408947
RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 004089E6

Strings

MRU, xrefs: 0040897F

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: MRU
API String ID: 1332880857-344939820
Opcode ID: 845d2110dc0d070f6aad7f860df3a24118c130d8e70c858ad76698d3bd0dcbf9
Instruction ID: f22ab4a82fd2cd57d0579e0df880e18baf2207f6d239757fe164980efb60308f
Opcode Fuzzy Hash: 845d2110dc0d070f6aad7f860df3a24118c130d8e70c858ad76698d3bd0dcbf9
Instruction Fuzzy Hash: 8A21187190010CBACF11AF91CD42FEE7BB9BF04304F10C4BAB555B50A1DBB95A91AF99

Function 00401A62 Relevance: 6.1, APIs: 4, Instructions: 87registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00401AA7
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,?,?,00000000,?,?), ref: 00401AC2
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000000,00000001,?,?,00000000,?,00000000,?,?,?,00000000), ref: 00401AF8
RegCloseKey.ADVAPI32(?,?,?,00000000,?,00000000,?,?,?,00000000,?,?), ref: 00401B1A

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 734e63243a4b052f08d431ee154be782bdd0b703d78beaf39269d2a8b41075f7
Instruction ID: fcd29aeafba084525d8cf8d477a30aef63fb09e727f4365931236e5964b75f7d
Opcode Fuzzy Hash: 734e63243a4b052f08d431ee154be782bdd0b703d78beaf39269d2a8b41075f7
Instruction Fuzzy Hash: 86213931A00109FBDF119E95CD42FEE7BB9AB41344F104076F900A61A0EB799E95DB59

Function 0040B9ED Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 85stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(00000000,logins), ref: 0040BA2B
lstrcmp.KERNEL32(table,?), ref: 0040BA60

Part of subcall function 0040B6D9: StrStrIA.SHLWAPI(?,() ), ref: 0040B6E9

Strings

logins, xrefs: 0040BA23
table, xrefs: 0040BA5B

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: lstrcmplstrcmpi
String ID: logins$table
API String ID: 3524194181-3800951466
Opcode ID: 755972dacdf0f538ccdf233cfaf82257552857a2a336d6a9199289e497d3ea6f
Instruction ID: e56b1581308bb119fc6df0d215a42fb934329492a1a349210f13653206e09008
Opcode Fuzzy Hash: 755972dacdf0f538ccdf233cfaf82257552857a2a336d6a9199289e497d3ea6f
Instruction Fuzzy Hash: 3331263190020DEBCF21AF90DC45ADE7B7CEB44324F508A67A120B52E4D735AA948B99

Function 00406B9D Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

"password" : ", xrefs: 00406BE7, 00406BFA

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID:
String ID: "password" : "
API String ID: 0-2310853927
Opcode ID: 1d96a41895556b83251d2f6e3fb8b7d77ae918bc5314d5579c167f32989cd641
Instruction ID: 2d33af965a49b69b8bb2625fc5117d1ac98ebf99c167de9e1e88c861068832c0
Opcode Fuzzy Hash: 1d96a41895556b83251d2f6e3fb8b7d77ae918bc5314d5579c167f32989cd641
Instruction Fuzzy Hash: FA21AE31804119BADF12BBA1CD029EE7E75EF51348F110037F442B61B1D6BD5EA1A7AD

Function 0040CEAD Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040CEF7

Part of subcall function 00401752: LocalFree.KERNEL32(00000000,?,004022A7,?,?,?,?,?,?), ref: 0040175E

Strings

SOFTWARE\Robo-FTP 3.7\Scripts, xrefs: 0040CEBC, 0040CF05
FTP File%d, xrefs: 0040CEEE
FTP Count, xrefs: 0040CEB7

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: FreeLocalwsprintf
String ID: FTP Count$FTP File%d$SOFTWARE\Robo-FTP 3.7\Scripts
API String ID: 988369812-376751567
Opcode ID: b100f10a11de84d1554b8ee285c05a23e3408d70a51dad86b1af9e0baeba858a
Instruction ID: 8ee0aa49f3dbd8388e6bbf4cfe452c84595b2709f6b7922b7d1b8c782d6353d8
Opcode Fuzzy Hash: b100f10a11de84d1554b8ee285c05a23e3408d70a51dad86b1af9e0baeba858a
Instruction Fuzzy Hash: 39017CB0900109FADF10AB91CC82EEEBA7AAB00315F108137F411B11E1D7BE9B849799

Function 00401226 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,80000000,00000003,00000000,00000003,00000000), ref: 00401236
ReadFile.KERNEL32(?,?,00001000,?,00000000,?,80000000,00000003,00000000,00000003,00000000), ref: 0040125A
CloseHandle.KERNEL32(?,?,?,00001000,?,00000000,?,80000000,00000003,00000000,00000003,00000000), ref: 00401266

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseExitFileHandleProcessRead
String ID:
API String ID: 1390701169-0
Opcode ID: 8f966ebd87d4ad1bdfb4cacc6edce40de60726eb4d26d5180a226f6d6868328b
Instruction ID: 2769c8dea532226ecc7d7cd99d09141729edcd609d6b994a67629c6e1451f681
Opcode Fuzzy Hash: 8f966ebd87d4ad1bdfb4cacc6edce40de60726eb4d26d5180a226f6d6868328b
Instruction Fuzzy Hash: F5F0FF31A50109BADF21AB50DD02FDDBA78AB1534DF1040B7B540F50E0D7B99B98DB58

Function 00401BCD Relevance: 5.0, APIs: 4, Instructions: 29stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 00401BEE
lstrlen.KERNEL32(00000000,?), ref: 00401BF8
lstrcpy.KERNEL32(00000000,?), ref: 00401C0C
lstrcat.KERNEL32(00000000,00000000), ref: 00401C15

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcatlstrcpy
String ID:
API String ID: 2414487701-0
Opcode ID: 80e65f7138c994cfb0136878f4e839e7a3c5ce9296fa90b956dbb6bd114dbf42
Instruction ID: 7210d46c7f977a387d5a4157f85995c79d660d03c9cb68f517295ba27315881e
Opcode Fuzzy Hash: 80e65f7138c994cfb0136878f4e839e7a3c5ce9296fa90b956dbb6bd114dbf42
Instruction Fuzzy Hash: 7AF01C7520020CBEDF207F62CC81A993AA9EB1135DF10D03BB915291A2E77DC9889B68

Function 0040F8E7 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00403C18: WSAStartup.WSOCK32(00000101,?), ref: 00403C2D

Sleep.KERNEL32(00001388,00000000,00000000,?,00000000), ref: 0040F9A3

Strings

http://gunnylaumienphi2017.com/, xrefs: 0040F939, 0040F955
Client Hash, xrefs: 0040F9C6

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: SleepStartup
String ID: Client Hash$http://gunnylaumienphi2017.com/
API String ID: 1372284471-2480438733
Opcode ID: 30d78c3068bdcfbc927ffa464f9ab81e646ffec13decf9da64cf830e54140e18
Instruction ID: 7f5d7b3c7258f9699e047d75cdfbc3d880843b63fda77a6a8c62c076c1915490
Opcode Fuzzy Hash: 30d78c3068bdcfbc927ffa464f9ab81e646ffec13decf9da64cf830e54140e18
Instruction Fuzzy Hash: D62115B190010AAADF31DBE1C9457BFB674AB04308F10043BE640719E1D7BD4E8DDBAA

Function 00409C84 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI(007203F8,Odin), ref: 00409CD6

Part of subcall function 00401752: LocalFree.KERNEL32(00000000,?,004022A7,?,?,?,?,?,?), ref: 0040175E

Strings

Odin, xrefs: 00409CD0
SiteInfo.QFP, xrefs: 00409CAC, 00409CEB

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: FreeLocal
String ID: Odin$SiteInfo.QFP
API String ID: 2826327444-4277389770
Opcode ID: 7b2b0562af19308cab5df3c240f8d3627445577c8b0d13b07810e0c4eeb6aee6
Instruction ID: 52af3856d4285a76f2f3712edfb672eb9e336cfc887af513c2a4a8862b141f07
Opcode Fuzzy Hash: 7b2b0562af19308cab5df3c240f8d3627445577c8b0d13b07810e0c4eeb6aee6
Instruction Fuzzy Hash: D901C430A4410579EB212B329D02FAE3E999B81314F24003BB815762E3D7BC9F41D2AD

Function 004071B4 Relevance: 4.6, APIs: 3, Instructions: 51registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,?,?), ref: 004071C7
RegEnumValueA.ADVAPI32(?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 004071FB
RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 0040725E

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpenValue
String ID:
API String ID: 4012628704-0
Opcode ID: e3f31528690a5d0e6c30948a6af74a0b1baa7a872ff4fcafd0ccf506f34d5b5a
Instruction ID: 86490294541cbf832a13796b5331e8b82cba92c417051bbcab69bd2e8fbd4de6
Opcode Fuzzy Hash: e3f31528690a5d0e6c30948a6af74a0b1baa7a872ff4fcafd0ccf506f34d5b5a
Instruction Fuzzy Hash: 1E11F87180410CBADF21AF90CC41BDEBBB9BF04304F1084BAB514B51A1DBB9AA959F99

Function 0040EF8E Relevance: 4.6, APIs: 3, Instructions: 50registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,?,?), ref: 0040EFA1
RegEnumKeyExA.ADVAPI32(?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 0040EFD5
RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 0040F02F

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: dd645579e3552e097291bef1b6578a3e97a18589981779f92997be476961d565
Instruction ID: 58e7d6fa5fdf71006491fd843ec2fce7242496fc44c56e62908c852a227b0491
Opcode Fuzzy Hash: dd645579e3552e097291bef1b6578a3e97a18589981779f92997be476961d565
Instruction Fuzzy Hash: 0011003590010CBADF11AF91CC01FDE7BB9BF04304F108976B514B51E1DBB99AA5AF54

Function 0040EEEF Relevance: 4.5, APIs: 3, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,?,?), ref: 0040EF02
RegEnumKeyExA.ADVAPI32(?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 0040EF32
RegCloseKey.ADVAPI32(?,?,00000000,?,000007FF,00000000,00000000,00000000,00000000,?,?,?), ref: 0040EF85

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: 2b145e644b25eb118bebfec26bb60c2a092f0f550df4e1e63f2e08a3bfc347f0
Instruction ID: 79d6ce66a9fe8589202b4e2849e13dc79f14a179371f355af88fa3d1fb127eda
Opcode Fuzzy Hash: 2b145e644b25eb118bebfec26bb60c2a092f0f550df4e1e63f2e08a3bfc347f0
Instruction Fuzzy Hash: 1A110C3191010DBADF11AF91CC02FDE7BB9BF00304F2085B6B514B51A1DBB99AA1AF58

Function 0040C756 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI(?,EasyFTP), ref: 0040C78D

Part of subcall function 00402200: lstrlen.KERNEL32(?), ref: 00402214
Part of subcall function 00402200: StrStrIA.SHLWAPI(00000000,.exe,?), ref: 00402233
Part of subcall function 00402200: StrRChrIA.SHLWAPI(00000000,00000000,0000005C,00000000,.exe,?), ref: 00402245
Part of subcall function 00402200: lstrlen.KERNEL32(00000000,00000000,00000000,0000005C,00000000,.exe,?), ref: 00402257

Part of subcall function 00401752: LocalFree.KERNEL32(00000000,?,004022A7,?,?,?,?,?,?), ref: 0040175E

Strings

EasyFTP, xrefs: 0040C785
SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32, xrefs: 0040C76F

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: lstrlen$FreeLocal
String ID: EasyFTP$SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32
API String ID: 1884169789-2776585315
Opcode ID: ec2090e60952daeec575351be475198956329dce5317bbbe5c5100064533b710
Instruction ID: 85cbf298f16898ee1e3ad3f2dea4e738ee09b13af73ee811f42477477b6d9026
Opcode Fuzzy Hash: ec2090e60952daeec575351be475198956329dce5317bbbe5c5100064533b710
Instruction Fuzzy Hash: 98F06D30A50209FAEF103BA1CC83FAD7E75AB00B44F20413ABA01791F2DBB95B509A5C

Function 00401C86 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00401769: LocalAlloc.KERNEL32(00000040,00402200,?,00402280,?), ref: 00401777

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,00000105), ref: 00401CB1

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 00401CE6

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: AllocFolderLocalPath
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
API String ID: 1254228173-2036018995
Opcode ID: ecacdd65099fff17406014d1aaabd04013573c28d7e727f9bbd7af76f059d322
Instruction ID: 97deef55f889460ea03d1c0e73911c6992c1b02bd37731b1ccd0826d76856a05
Opcode Fuzzy Hash: ecacdd65099fff17406014d1aaabd04013573c28d7e727f9bbd7af76f059d322
Instruction Fuzzy Hash: 93017171A48205EFEB119B54CE41B9AB7B4AB00714F248137E612BA1F0E778EA50EB4D

Function 00407A4B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00407A6F

Part of subcall function 00401BCD: lstrlen.KERNEL32(?), ref: 00401BEE
Part of subcall function 00401BCD: lstrlen.KERNEL32(00000000,?), ref: 00401BF8
Part of subcall function 00401BCD: lstrcpy.KERNEL32(00000000,?), ref: 00401C0C
Part of subcall function 00401BCD: lstrcat.KERNEL32(00000000,00000000), ref: 00401C15

Part of subcall function 00401752: LocalFree.KERNEL32(00000000,?,004022A7,?,?,?,?,?,?), ref: 0040175E

Strings

\32BitFtp.ini, xrefs: 00407A7F

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: lstrlen$DirectoryFreeLocalWindowslstrcatlstrcpy
String ID: \32BitFtp.ini
API String ID: 2776971706-1260517637
Opcode ID: 1cb0484594f6157d45a57629beea73c99a87447080c23abbe336f535a30bf1ea
Instruction ID: b264c63a17963ad57f187d581c1cea9d5644dcb8ea268a62fb368e62467bf330
Opcode Fuzzy Hash: 1cb0484594f6157d45a57629beea73c99a87447080c23abbe336f535a30bf1ea
Instruction Fuzzy Hash: E5F08270A00108BAEF10BBA1CC42FDE7A689F44748F100477B644F51E2DBF9AB905B5C

Function 004022AB Relevance: 3.0, APIs: 2, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 004022B4
GetProcAddress.KERNEL32(00000000,?), ref: 004022E2

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 0f749165927d9a0347e95b2b40a320660c170a1640660f197713828e4d2df242
Instruction ID: d06432f4dc182ffac08f2039f883e23e9f9a8286cc76ceb82120973f00c3edba
Opcode Fuzzy Hash: 0f749165927d9a0347e95b2b40a320660c170a1640660f197713828e4d2df242
Instruction Fuzzy Hash: 3DF0B47721501516D7106579AD44A9B6F88E7E3378B10513BF805B62C1E1FDDDC2C3A4

Function 0040E148 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 0040E185

Strings

.xml, xrefs: 0040E194

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: .xml
API String ID: 1659193697-2937849440
Opcode ID: 5612f15b83e4f5c0da68c40290cebea3554d9c95b9dfa89e0058544d4126d0e4
Instruction ID: 09eced1d0fe3324484a059412de8bbb336304f1bc4f3e6890493b41d3b7db345
Opcode Fuzzy Hash: 5612f15b83e4f5c0da68c40290cebea3554d9c95b9dfa89e0058544d4126d0e4
Instruction Fuzzy Hash: 77F03A35900108FACF11EF91DD02ECDBB76AB15308F208176F211B51F0D7B95B64AB48

Function 00401D0B Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,00000080,00000000,00000000,00000003,00000000,00000000), ref: 00401D37
CloseHandle.KERNEL32(00000000,?,00000080,00000000,00000000,00000003,00000000,00000000), ref: 00401D44

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseExitHandleProcess
String ID:
API String ID: 1046136549-0
Opcode ID: 7fa46683cff65880fc07046521540c40611a923bba942e464b42245b21033316
Instruction ID: 98c49b96a8b54ac0c31122d9ec1678d3f25e6b270c6518dc4dcec6e943226a25
Opcode Fuzzy Hash: 7fa46683cff65880fc07046521540c40611a923bba942e464b42245b21033316
Instruction Fuzzy Hash: E7E0BF7235024537FB315569EC83F5676985B12758F604433B641FD2D1D5FDF940826C

Function 0040FF99 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040FF99
ExitProcess.KERNEL32(00000000), ref: 0040FFB7

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CountExitProcessTick
String ID:
API String ID: 232575682-0
Opcode ID: b844b7522c695be4dfb9276ea611e68d84ca933084dc7cddcdf456fcc53f69ad
Instruction ID: 06dacf7b5bdf3065d43742cdf2570900850f9260e3093aa6ddbde68aacd5c01f
Opcode Fuzzy Hash: b844b7522c695be4dfb9276ea611e68d84ca933084dc7cddcdf456fcc53f69ad
Instruction Fuzzy Hash: FBC092A076C11349E2B87273094632E10035BE3708F65C03FF10A35DCA8DBC489E211F

Function 00401422 Relevance: 1.5, APIs: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00401439

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: ccf179241871f6042aa2775e6511bbdf144520f0f47ed731e2d5e649bf96b33e
Instruction ID: 251c42277766ed9646b5a9c3b1c0fe41e3bd1f0ee4844d3e2f798b7a9c3cdedb
Opcode Fuzzy Hash: ccf179241871f6042aa2775e6511bbdf144520f0f47ed731e2d5e649bf96b33e
Instruction Fuzzy Hash: C4E0393291011AABCF20DAA89C01BDE77A8AB11368F044136B910E62E0E7B5DB50C7A9

Function 0040FF9A Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040FF99
ExitProcess.KERNEL32(00000000), ref: 0040FFB7

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CountExitProcessTick
String ID:
API String ID: 232575682-0
Opcode ID: db0779cbd658f11ac7167aa01f898edc599809d2dbb1fe85f57ab945cd90ea10
Instruction ID: 002f6f85b3c0520e91da88d753ec90e409b49d1574653ab2620fa8804466fc11
Opcode Fuzzy Hash: db0779cbd658f11ac7167aa01f898edc599809d2dbb1fe85f57ab945cd90ea10
Instruction Fuzzy Hash: FCC0122072C34189C36153611C5538A3A120B97304F55C0BBD004258D6D478088A425F

Function 00403C18 Relevance: 1.5, APIs: 1, Instructions: 9networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00403C2D

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 30164bad9e7e3c908d95e258457be95fc7c7aeee42e52043797345d1f1a8d3c3
Instruction ID: 7b0ce69c0cb2004bd621d2ace6d0e8ba3c64a41308b07c2816557fadd6d817c3
Opcode Fuzzy Hash: 30164bad9e7e3c908d95e258457be95fc7c7aeee42e52043797345d1f1a8d3c3
Instruction Fuzzy Hash: 3FB0923161020836EA10A2958C439DA72AD4748708F4002A12A59D12C2EAEAEAC046EA

Function 00401011 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00401018

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID:
API String ID: 2244384528-0
Opcode ID: 86a8ec1850b9aaa514b9e5e89e8c94cfed7fea3bececbbbc2fb57b3281181469
Instruction ID: 28e71356e360ca3db6ee0d43e78b0f0bf00f1f89270a16bc3e7bce26a30f1f77
Opcode Fuzzy Hash: 86a8ec1850b9aaa514b9e5e89e8c94cfed7fea3bececbbbc2fb57b3281181469
Instruction Fuzzy Hash: 27A022323C020032EE00AB80AC03FCC2C020BA8B8CF00C002BB082C0C0C8FAC0E2A22A

Function 00401752 Relevance: 1.3, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,?,004022A7,?,?,?,?,?,?), ref: 0040175E

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: FreeLocal
String ID:
API String ID: 2826327444-0
Opcode ID: 137a773f6ae48b6ee33adf6dcf8c71acbe3b08eb172555d78977b267df3d9f64
Instruction ID: 0a405eb3ea2237b8c7d3b2374792eb0735da3c41d5461f0553682d87d0295bc0
Opcode Fuzzy Hash: 137a773f6ae48b6ee33adf6dcf8c71acbe3b08eb172555d78977b267df3d9f64
Instruction Fuzzy Hash: C5C02B3100010D91C7113E34C949B4A39C4572034CF0080323508A08F0C678C690C1C8

Function 00401769 Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00402200,?,00402280,?), ref: 00401777

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 175009169b3b3cea6a064c991676caba20ef80de107dd71c414f8110d5986276
Instruction ID: 0d23249a0e78e6512e579298220552806d91460745143d34d93349aebd84a825
Opcode Fuzzy Hash: 175009169b3b3cea6a064c991676caba20ef80de107dd71c414f8110d5986276
Instruction Fuzzy Hash: 84B092A120030826E250A649D803F1AB28C9B11B4CF008032BB44E62C2C9B8F91481AD

Non-executed Functions

Function 00409414 Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 169filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 00409484
lstrcmpiA.KERNEL32(00411EA6,?), ref: 004094B1
lstrcmpiA.KERNEL32(00411EA8,?), ref: 004094CE
FindNextFileA.KERNEL32(?,?,00000000,00000000,?,signons2.txt,00000000,?,signons.txt,?,?,signons.sqlite,00000000,?), ref: 00409664
FindClose.KERNEL32(?,?,?,00000000,00000000,?,signons2.txt,00000000,?,signons.txt,?,?,signons.sqlite,00000000,?), ref: 00409677

Part of subcall function 00401BCD: lstrlen.KERNEL32(?), ref: 00401BEE
Part of subcall function 00401BCD: lstrlen.KERNEL32(00000000,?), ref: 00401BF8
Part of subcall function 00401BCD: lstrcpy.KERNEL32(00000000,?), ref: 00401C0C
Part of subcall function 00401BCD: lstrcat.KERNEL32(00000000,00000000), ref: 00401C15

Strings

signons.sqlite, xrefs: 00409583
*.*, xrefs: 00409453
signons2.txt, xrefs: 004095FA
prefs.js, xrefs: 0040953D
signons.txt, xrefs: 004095E9
\*.*, xrefs: 00409444
signons3.txt, xrefs: 0040960B

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: Find$Filelstrcmpilstrlen$CloseFirstNextlstrcatlstrcpy
String ID: *.*$\*.*$prefs.js$signons.sqlite$signons.txt$signons2.txt$signons3.txt
API String ID: 3040542784-1405255088
Opcode ID: f0f0ab89c6ef816c1f5cdb2bcce169c3b320ecfc182607a20e6cbbfd06447570
Instruction ID: f078e26bfb360da23a87b834dff21d2cd796a551ffced0913c93ca374c7af2dc
Opcode Fuzzy Hash: f0f0ab89c6ef816c1f5cdb2bcce169c3b320ecfc182607a20e6cbbfd06447570
Instruction Fuzzy Hash: DC513F70914209BADF21BF61DD02EEA7A75AF04308F1044B7B908B11F2D7BE9E919B5D

Function 00402ABC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

explorer.exe, xrefs: 00402B44

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID:
String ID: explorer.exe
API String ID: 0-3187896405
Opcode ID: c2717998afd40274a0e18a5117ed09a6326ae842430f85bb60fcf48e658aaa65
Instruction ID: 339f67933faa4902912e8113d0e12cd211fbe269d324ef67944da57c1fce070e
Opcode Fuzzy Hash: c2717998afd40274a0e18a5117ed09a6326ae842430f85bb60fcf48e658aaa65
Instruction Fuzzy Hash: 7C317230A04218ABEF229BA1DE49BEE7AB5AB04344F0045B7E104B11E1DBF95E84DF59

Function 0040FCA6 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

123456, xrefs: 0040FD8B, 0040FD9F

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID:
String ID: 123456
API String ID: 0-158520161
Opcode ID: 2c5fbe4573f16d8fab2cf4876be527e79393b4457eed74dee052666c98a27ef3
Instruction ID: 885172f44155ff4289d4fb693edf733573c9f98d175cf26bc1040d56c290aa1b
Opcode Fuzzy Hash: 2c5fbe4573f16d8fab2cf4876be527e79393b4457eed74dee052666c98a27ef3
Instruction Fuzzy Hash: B6514F31900209EAEF219F91DD46BDDBFB5FF04348F148076E600B55E2D7B98A48DB68

Function 0040A139 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 105stringencryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00409E8B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000003FF,00000000,00000000), ref: 00409EC4
Part of subcall function 00409E8B: CoTaskMemFree.OLE32(?,00000000,00000000,?,000000FF,?,000003FF,00000000,00000000), ref: 00409ECD

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000003FF,00000000,00000000), ref: 0040A16D
lstrcmpiA.KERNEL32(?,Internet Explorer), ref: 0040A1F7
lstrcmpiA.KERNEL32(?,WininetCacheCredentials), ref: 0040A216
lstrcmpiA.KERNEL32(?,MS IE FTP Passwords), ref: 0040A235
StrStrIA.SHLWAPI(?,DPAPI: ,?,Internet Explorer), ref: 0040A24E
CryptUnprotectData.CRYPT32(00000000,00000000,00000000,00000000,00000000,00000001,?), ref: 0040A294
LocalFree.KERNEL32(?), ref: 0040A2C1
CoTaskMemFree.OLE32(00000000,?,DPAPI: ,?,Internet Explorer), ref: 0040A2EB

Strings

Internet Explorer, xrefs: 0040A1EB
WininetCacheCredentials, xrefs: 0040A20A
MS IE FTP Passwords, xrefs: 0040A229
DPAPI: , xrefs: 0040A242

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: Freelstrcmpi$ByteCharMultiTaskWide$CryptDataLocalUnprotect
String ID: DPAPI: $Internet Explorer$MS IE FTP Passwords$WininetCacheCredentials
API String ID: 2957877119-3076635702
Opcode ID: feb5cb5b94d68b1118f19efbded5a9befba7026c3d79461e7fe2bf79bfc015a0
Instruction ID: f401766838be715e7df61eb103f318295b24ae2e2e23771a2c77150a89ec6b22
Opcode Fuzzy Hash: feb5cb5b94d68b1118f19efbded5a9befba7026c3d79461e7fe2bf79bfc015a0
Instruction Fuzzy Hash: 2A41097190021DEADF219F50CC06FDA7BB9BF08304F0480EAB644B5191DB7A9AE59FD9

Function 0040B818 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 140stringencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(00000000,00000000,00000000,00000000,00000000,00000001,?), ref: 0040B8CF
LocalFree.KERNEL32(00000000,?), ref: 0040B90A
lstrlen.KERNEL32(ftp://,?,?,00000000,00000000,00000000,?), ref: 0040B94B
StrCmpNIA.SHLWAPI(?,ftp://,00000000,ftp://,?,?,00000000,00000000,00000000,?), ref: 0040B959
lstrlen.KERNEL32(http://,?,ftp://,00000000,ftp://,?,?,00000000,00000000,00000000,?), ref: 0040B967
StrCmpNIA.SHLWAPI(?,http://,00000000,http://,?,ftp://,00000000,ftp://,?,?,00000000,00000000,00000000,?), ref: 0040B975
lstrlen.KERNEL32(https://,?,ftp://,00000000,ftp://,?,?,00000000,00000000,00000000,?), ref: 0040B983
StrCmpNIA.SHLWAPI(?,https://,00000000,https://,?,ftp://,00000000,ftp://,?,?,00000000,00000000,00000000,?), ref: 0040B991

Strings

ftp://, xrefs: 0040B946, 0040B951
https://, xrefs: 0040B97E, 0040B989
http://, xrefs: 0040B962, 0040B96D

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: lstrlen$CryptDataFreeLocalUnprotect
String ID: ftp://$http://$https://
API String ID: 3968356742-2804853444
Opcode ID: cc6fa941d3240ba3dffb52b22ee328574de5633c9d4cb607f2d79f4d50549dae
Instruction ID: b19ace0abd7eac20551f2d5fc40b49bbbced65cf98b86b072bc85626dd3b29c5
Opcode Fuzzy Hash: cc6fa941d3240ba3dffb52b22ee328574de5633c9d4cb607f2d79f4d50549dae
Instruction Fuzzy Hash: BF51E672900109FACF12AFD1EC42EEE7B7AEB44309F108037F611B50A1D77A5A54DB59

Function 00408543 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 104filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 004085B3
lstrcmpiA.KERNEL32(00411EA6,?), ref: 004085DC
lstrcmpiA.KERNEL32(00411EA8,?), ref: 004085F9
FindNextFileA.KERNEL32(?,?,?,?,00000000,?), ref: 004086A0
FindClose.KERNEL32(?,?,?,?,?,00000000,?), ref: 004086B3

Part of subcall function 00401BCD: lstrlen.KERNEL32(?), ref: 00401BEE
Part of subcall function 00401BCD: lstrlen.KERNEL32(00000000,?), ref: 00401BF8
Part of subcall function 00401BCD: lstrcpy.KERNEL32(00000000,?), ref: 00401C0C
Part of subcall function 00401BCD: lstrcat.KERNEL32(00000000,00000000), ref: 00401C15

Strings

*.*, xrefs: 00408582
\*.*, xrefs: 00408573

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: Find$Filelstrcmpilstrlen$CloseFirstNextlstrcatlstrcpy
String ID: *.*$\*.*
API String ID: 3040542784-1692270452
Opcode ID: dee79c63cfed158fb1c5fb456c9f386bd851ae0be0562eccb3adeea9a6142c65
Instruction ID: de00ff37c846c8476ad0b937f69e9334585cc62ec1e68734680259d3cbd4a832
Opcode Fuzzy Hash: dee79c63cfed158fb1c5fb456c9f386bd851ae0be0562eccb3adeea9a6142c65
Instruction Fuzzy Hash: 69314470500209AADF11AB61DD01EEE77B9AF04304F1049BBB948B51F1DB799ED09A58

Function 0040A54F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 88stringencryptionCOMMON

Download Yara Rule

APIs

CredEnumerateA.ADVAPI32(Microsoft_WinInet_*,00000000,00000000,00000000), ref: 0040A5C1
lstrlenW.KERNEL32(00413275,?,?,00000000), ref: 0040A5FF
CryptUnprotectData.CRYPT32(00000000,00000000,?,00000000,00000000,00000001,?), ref: 0040A62F
LocalFree.KERNEL32(00000000), ref: 0040A661
CredFree.ADVAPI32(00000000), ref: 0040A67F

Strings

u2A, xrefs: 0040A569
Microsoft_WinInet_*, xrefs: 0040A5BC

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CredFree$CryptDataEnumerateLocalUnprotectlstrlen
String ID: Microsoft_WinInet_*$u2A
API String ID: 3891647360-1717749884
Opcode ID: f2b9b52f09b627ba91158a8d4e26bef8a4bcd467c37c94d826325fd16cc1659b
Instruction ID: a7d8e005c27115d7c2d26dd6ef0ae6fc1f38b51df9cf3295d8c3d9fd3ebbafd4
Opcode Fuzzy Hash: f2b9b52f09b627ba91158a8d4e26bef8a4bcd467c37c94d826325fd16cc1659b
Instruction Fuzzy Hash: B5312B71800209EADF209F90DC05BEEBBB8BB04305F184576E641B12E0D7BA5A94CB9A

Function 0040CA1F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 116stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000), ref: 0040CAC4
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 0040CB2A
LocalFree.KERNEL32(00000000), ref: 0040CB51

Strings

password 51:b:, xrefs: 0040CA83
full address:s:, xrefs: 0040CA96
username:s:, xrefs: 0040CA70

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotectlstrlen
String ID: full address:s:$password 51:b:$username:s:
API String ID: 2920030623-2945746679
Opcode ID: 5a4aa130149a7864f96d2caa5a8bd5db8e6769597c0901092ac328538414656e
Instruction ID: fa303a7f78ff015c66e7f5f047ee1bd5f96a69690f6c653c9b76103944328498
Opcode Fuzzy Hash: 5a4aa130149a7864f96d2caa5a8bd5db8e6769597c0901092ac328538414656e
Instruction Fuzzy Hash: 93415C32D00109EADF21ABE5D846BEEBB75EB44314F10013BF200711E0D7B95A92DB9D

Function 0040A706 Relevance: 4.6, APIs: 3, Instructions: 121stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 0040A71B
CryptUnprotectData.CRYPT32(00000000,00000000,00000000,00000000,00000000,00000001,?), ref: 0040A7D3
LocalFree.KERNEL32(00000000), ref: 0040A806

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotectlstrlen
String ID:
API String ID: 2920030623-0
Opcode ID: 8c3423fde507b97bc5dc80952f4c4f7a43aaee8c73ae507500d09105da1b5f30
Instruction ID: 83b7a2fcf0e51bbc56470a161055dde31258554073f6f43092e3c13268cc997d
Opcode Fuzzy Hash: 8c3423fde507b97bc5dc80952f4c4f7a43aaee8c73ae507500d09105da1b5f30
Instruction Fuzzy Hash: 0E31B3376002099BEF20AE54D844BCEB775EB85364F10C137EA50A72C0D27CDA56CB5E

Function 004040EF Relevance: 4.6, APIs: 3, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0040414E
CheckTokenMembership.ADVAPI32(00000000,?,00000000), ref: 0040416A
FreeSid.ADVAPI32(?), ref: 0040417E

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 8875248de65d89068c49fc9c91a7eb01479aeaa87efd2b03388409123db240e4
Instruction ID: fcca649b5c9b222fb78caba8243c0119fbbb0da3718ef36efae507d1f91828ab
Opcode Fuzzy Hash: 8875248de65d89068c49fc9c91a7eb01479aeaa87efd2b03388409123db240e4
Instruction Fuzzy Hash: E0116170604288DEEB11CB94DC0EFDA7FF4AB5034CF0885A5D250EA2F2D3B89548C75A

Function 00403FF9 Relevance: 3.1, APIs: 2, Instructions: 57encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(00000000,00000000,00000000,00000000,00000000,00000001,?), ref: 00404045
LocalFree.KERNEL32(00000000), ref: 00404079

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 1d3115f653053ecefc300207beb17d1587e5c5b299ee93d5987816e0cda49adf
Instruction ID: 002495ce28a5764f73250fbc4ec026de7f96150d115926febcdcd66189658153
Opcode Fuzzy Hash: 1d3115f653053ecefc300207beb17d1587e5c5b299ee93d5987816e0cda49adf
Instruction Fuzzy Hash: FE110775A00219EBDB15CE94C845BDE7B74FB44351F008466A611762E0C3B9AA40CB45

Function 00402CD2 Relevance: .5, Instructions: 529COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b572f9d2c9c2a1160aa7d0b082204b5005edb68fc1495acda48a505fa1360f70
Instruction ID: 3c78efb6b6252997e37dba53990d4c41ba62dc3b41e308827f1f696989bfbd42
Opcode Fuzzy Hash: b572f9d2c9c2a1160aa7d0b082204b5005edb68fc1495acda48a505fa1360f70
Instruction Fuzzy Hash: 8B121E73405A015BE75DCE2ECCC0692B3E3BBD826435BD63DC46AC3A45FE74B61A8648

Function 004104C9 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03deaa5e7ac288ae455c8890013846e685306e418c958c7845be627a36af68f0
Instruction ID: fef48ed7f26f4b91a03165647bc533b2e212d921c779cbc8725f1bb403e01c98
Opcode Fuzzy Hash: 03deaa5e7ac288ae455c8890013846e685306e418c958c7845be627a36af68f0
Instruction Fuzzy Hash: 1D71C137F505364BE7588DAA8981195F7D2ABC8320B1F827ECE19F7381C9B4BD1286C4

Function 004090BA Relevance: 36.2, APIs: 16, Strings: 8, Instructions: 238COMMON

Download Yara Rule

Strings

ftp://, xrefs: 0040928D, 00409298
#2d, xrefs: 0040913D
#2c, xrefs: 0040912F
---, xrefs: 004093BF
http://, xrefs: 004092A9, 004092B4
https://, xrefs: 004092C5, 004092D0
ftp., xrefs: 004092E8, 004092F3
#2e, xrefs: 0040914B

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID:
String ID: #2c$#2d$#2e$---$ftp.$ftp://$http://$https://
API String ID: 0-1526611526
Opcode ID: 75be8d959a3ef46cda475649a3b2f5335f473a6aae9f3cf828271b51f02723bf
Instruction ID: 20c96ff4ef7ca75ed0c1a3f9f91715f39d6713f9170a09e911abe15c08339f7d
Opcode Fuzzy Hash: 75be8d959a3ef46cda475649a3b2f5335f473a6aae9f3cf828271b51f02723bf
Instruction Fuzzy Hash: F291F670904109EADF21AFA1DD46BAEBEB5AF04308F20403BF501751E2D7BE4E959B59

Function 00408E4D Relevance: 22.7, APIs: 8, Strings: 7, Instructions: 165COMMON

Download Yara Rule

Strings

ftp://, xrefs: 00408F5A, 00408F65
http://, xrefs: 00408F76, 00408F81
https://, xrefs: 00408F92, 00408F9D
ftp., xrefs: 00408FB5, 00408FC0
SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins, xrefs: 00408ED0
mozsqlite3.dll, xrefs: 00408E8B
sqlite3.dll, xrefs: 00408E9E

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID:
String ID: SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins$ftp.$ftp://$http://$https://$mozsqlite3.dll$sqlite3.dll
API String ID: 0-3560805513
Opcode ID: 545cff59d4eda7f766d5b0df4497bf5a85fcbd4fc8714724cf6a74084cb58ec7
Instruction ID: e95dfbb8d8d990a8ab6e0530343e41f76290cb4ce0cde13c720cf05920f077ce
Opcode Fuzzy Hash: 545cff59d4eda7f766d5b0df4497bf5a85fcbd4fc8714724cf6a74084cb58ec7
Instruction Fuzzy Hash: 13511470940109BADF11ABA1CE06AEE7E75AF14309F10443BF541B01E2DBBD4AA1DB5D

Function 0040A820 Relevance: 21.2, APIs: 7, Strings: 7, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 00401769: LocalAlloc.KERNEL32(00000040,00402200,?,00402280,?), ref: 00401777

wsprintfA.USER32 ref: 0040A88C
wsprintfA.USER32 ref: 0040A89F
wsprintfA.USER32 ref: 0040A8B2
wsprintfA.USER32 ref: 0040A8C5
wsprintfA.USER32 ref: 0040A8D8
wsprintfA.USER32 ref: 0040A8EB
wsprintfA.USER32 ref: 0040A8FE

Part of subcall function 0040A706: lstrlen.KERNEL32(?), ref: 0040A71B

Part of subcall function 0040A706: CryptUnprotectData.CRYPT32(00000000,00000000,00000000,00000000,00000000,00000001,?), ref: 0040A7D3
Part of subcall function 0040A706: LocalFree.KERNEL32(00000000), ref: 0040A806

Part of subcall function 00401548: lstrlen.KERNEL32(00000000), ref: 00401554

Strings

SiteServer %d\WebUrl, xrefs: 0040A897
%s\Keychain, xrefs: 0040A8E3
SiteServer %d\SFTP, xrefs: 0040A8F6
SiteServer %d\Host, xrefs: 0040A884
SiteServer %d-User, xrefs: 0040A8BD
SiteServer %d\Remote Directory, xrefs: 0040A8AA
SiteServer %d-User PW, xrefs: 0040A8D0

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: wsprintf$Locallstrlen$AllocCryptDataFreeUnprotect
String ID: %s\Keychain$SiteServer %d-User$SiteServer %d-User PW$SiteServer %d\Host$SiteServer %d\Remote Directory$SiteServer %d\SFTP$SiteServer %d\WebUrl
API String ID: 3846021373-1012938452
Opcode ID: 2526abd854f4923f605afca51e82ce3a5495784b67bfd747cbcfbb8de1c7722a
Instruction ID: dc9777ff7e0b01a33503325bf57cf66e7db019083ebb8df2e8b3fd290b5606e8
Opcode Fuzzy Hash: 2526abd854f4923f605afca51e82ce3a5495784b67bfd747cbcfbb8de1c7722a
Instruction Fuzzy Hash: D1617371940208FBDF527FA1DD42AEDBB72AF04708F14803AF611351B2DB7A5A60EB59

Function 0040F127 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 103stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00409E8B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000003FF,00000000,00000000), ref: 00409EC4
Part of subcall function 00409E8B: CoTaskMemFree.OLE32(?,00000000,00000000,?,000000FF,?,000003FF,00000000,00000000), ref: 00409ECD

Part of subcall function 00409ED6: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000003FF,00000000,00000000), ref: 00409F12
Part of subcall function 00409ED6: CoTaskMemFree.OLE32(?,00000000,00000000,?,000000FF,?,000003FF,00000000,00000000), ref: 00409F1B

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000003FF,00000000,00000000), ref: 0040F170
lstrcmpiA.KERNEL32(?,identification), ref: 0040F1F0
lstrcmpiA.KERNEL32(?,identitymgr), ref: 0040F205
lstrcmpiA.KERNEL32(?,inetcomm server passwords), ref: 0040F228
lstrcmpiA.KERNEL32(?,outlook account manager passwords), ref: 0040F247
lstrcmpiA.KERNEL32(?,identities), ref: 0040F266
CoTaskMemFree.OLE32(00000000,?,inetcomm server passwords,?,identification), ref: 0040F2C7

Strings

identities, xrefs: 0040F25A
outlook account manager passwords, xrefs: 0040F23B
identification, xrefs: 0040F1E4
identitymgr, xrefs: 0040F1F9
inetcomm server passwords, xrefs: 0040F21C

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: lstrcmpi$ByteCharFreeMultiTaskWide
String ID: identification$identities$identitymgr$inetcomm server passwords$outlook account manager passwords
API String ID: 636431001-4287852900
Opcode ID: bb333d8fbd1e7255a575d737b61fc163956e0edd29ac13a13b9663bcba2d83ed
Instruction ID: 0e22ab3b2dc57d385f5d98c67c41156d2e2fceceff404690329680ab2f3ee2d4
Opcode Fuzzy Hash: bb333d8fbd1e7255a575d737b61fc163956e0edd29ac13a13b9663bcba2d83ed
Instruction Fuzzy Hash: 47413D3584021DEAEF219F91CD41FDA7B79BB09304F0041EAB608B5092DB799AD9DF94

Function 00402C04 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 61registryCOMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI(?,explorer.exe,00000002,00000000), ref: 00402B50
ProcessIdToSessionId.KERNEL32(?,00000000,?,explorer.exe,?,explorer.exe,00000002,00000000), ref: 00402B74
OpenProcess.KERNEL32(02000000,00000000,?), ref: 00402B9E
OpenProcessToken.ADVAPI32(?,000201EB,?,02000000,00000000,?), ref: 00402BB6
ImpersonateLoggedOnUser.ADVAPI32(?), ref: 00402BC3
RegOpenCurrentUser.ADVAPI32(000F003F,00000000), ref: 00402BE4
CloseHandle.KERNEL32(?), ref: 00402C09
CloseHandle.KERNEL32(?,?), ref: 00402C11
CloseHandle.KERNEL32(?), ref: 00402C1B
Process32Next.KERNEL32(?,00000128), ref: 00402C2D
CloseHandle.KERNEL32(?,00000002,00000000), ref: 00402C3D

Strings

explorer.exe, xrefs: 00402B44

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseHandle$OpenProcess$User$CurrentImpersonateLoggedNextProcess32SessionToken
String ID: explorer.exe
API String ID: 3144406365-3187896405
Opcode ID: 3322303f64adb676d8db25f6ed76fe5f098889783615bc13d16c4bcdfa4f3e92
Instruction ID: 5723e61b88d4e9f9222964c16d2d2afb6602735196ba38223fd4c3419d9b93c0
Opcode Fuzzy Hash: 3322303f64adb676d8db25f6ed76fe5f098889783615bc13d16c4bcdfa4f3e92
Instruction Fuzzy Hash: 27214230A14118ABEF229B51DE49BEEBBB4BB14344F1044B7E204F11E0DBB89E84DF59

Function 0040B61E Relevance: 15.1, APIs: 6, Strings: 4, Instructions: 63stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004026D3: lstrlen.KERNEL32(?), ref: 00402707

StrStrIA.SHLWAPI(?,004133CD), ref: 0040B632
lstrcmpiA.KERNEL32(CONSTRAINT,?), ref: 0040B654

Strings

origin_url, xrefs: 0040B681
CONSTRAINT, xrefs: 0040B64B
password_value, xrefs: 0040B69B
username_value, xrefs: 0040B6B5

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: lstrcmpilstrlen
String ID: CONSTRAINT$origin_url$password_value$username_value
API String ID: 3649823140-2401479949
Opcode ID: 83092cc97906ed6b200ae337b8dc46f63c20743d4bbdfc852c011f4a0e956700
Instruction ID: 9c5d8a244427796840b79d864bce391278a18baf4e7973b846767f3050b87988
Opcode Fuzzy Hash: 83092cc97906ed6b200ae337b8dc46f63c20743d4bbdfc852c011f4a0e956700
Instruction Fuzzy Hash: D3110035610009A6CF112F25EC01DDE3F61AB65398B008537F845A82A1E7BE89E5978D

Function 00403A02 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 133networkstringCOMMON

Download Yara Rule

APIs

Part of subcall function 00401769: LocalAlloc.KERNEL32(00000040,00402200,?,00402280,?), ref: 00401777

InternetCrackUrlA.WININET(?,00000000,80000000,0000003C), ref: 00403A75
InternetCreateUrlA.WININET(0000003C,80000000,?,00000FFF), ref: 00403AA0
InternetCrackUrlA.WININET(?,00000000,00000000,0000003C), ref: 00403AE6
wsprintfA.USER32 ref: 00403B0B

Part of subcall function 004039D4: 72A313D0.WSOCK32(?,0000FFFF,00000080,00000001,00000004), ref: 004039F9

lstrlen.KERNEL32(?,00001000,00001000,00001000), ref: 00403B36
closesocket.WSOCK32(?,?,00001000,00001000,00001000), ref: 00403B81

Strings

POST %s HTTP/1.0Host: %sAccept: */*Accept-Encoding: identity, *;q=0Content-Length: %luConnection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98), xrefs: 00403B03
<, xrefs: 00403AC0

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: Internet$Crack$A313AllocCreateLocalclosesocketlstrlenwsprintf
String ID: <$POST %s HTTP/1.0Host: %sAccept: */*Accept-Encoding: identity, *;q=0Content-Length: %luConnection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)
API String ID: 118042637-2005047030
Opcode ID: 87abe820bb0d6036ffe2e3babf49ec09694a1781688e39f6c4ff6adf4ca460de
Instruction ID: 1de9cb80474df7d9d3716ce442e77a1af239618b76ab67b58deaa212d5e7e0f6
Opcode Fuzzy Hash: 87abe820bb0d6036ffe2e3babf49ec09694a1781688e39f6c4ff6adf4ca460de
Instruction Fuzzy Hash: 3641A671D00209EADF11AFE1DC41BEEBFB9AF04349F10403AF510B51A2DBB96A55DB19

Function 004096A3 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 119COMMON

Download Yara Rule

Strings

Path, xrefs: 00409772
IsRelative, xrefs: 00409786
Profile, xrefs: 00409753
profiles.ini, xrefs: 004096F4

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID:
String ID: IsRelative$Path$Profile$profiles.ini
API String ID: 0-4107377610
Opcode ID: 737542b6f8ea86c960c44e09380ca456abda41aea68274e537a4f94da42fe37e
Instruction ID: 95d3b633096284f4bbd09f7529df532e569788953b1a2b841014d990d7b74c68
Opcode Fuzzy Hash: 737542b6f8ea86c960c44e09380ca456abda41aea68274e537a4f94da42fe37e
Instruction Fuzzy Hash: 7441383591014AFADF122FA19C42EAE7F72AF40344F14457BB510B51F2D7BA4DA1AB08

Function 0040384D Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 134stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00401769: LocalAlloc.KERNEL32(00000040,00402200,?,00402280,?), ref: 00401777

StrStrIA.SHLWAPI(?,Content-Length:), ref: 004038D5
lstrlen.KERNEL32(Content-Length:,00000000,?,Content-Length:), ref: 004038E6
StrToIntA.SHLWAPI(00000001,00000001,00000000,Content-Length:,00000000,?,Content-Length:), ref: 00403907
StrStrIA.SHLWAPI(?,Location:,?,Content-Length:), ref: 0040391E
lstrlen.KERNEL32(Location:,00000000,?,Location:,?,Content-Length:), ref: 0040392F

Strings

Location:, xrefs: 00403916, 0040392A
Content-Length:, xrefs: 004038CD, 004038E1

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: lstrlen$AllocLocal
String ID: Content-Length:$Location:
API String ID: 2140729754-2400408565
Opcode ID: 34bf45d2ae5e5f4909a357a932ac428661d7f98a5949df93852985c7b08e6a42
Instruction ID: 83ca887fabee062547b53eafaae993b34422474f705763326791051a1ec7c268
Opcode Fuzzy Hash: 34bf45d2ae5e5f4909a357a932ac428661d7f98a5949df93852985c7b08e6a42
Instruction Fuzzy Hash: 2141C375A04209BBDB10AFA5CC41B9EFF79EF41304F208177F610B62E1DBB98A519B58

Function 00404087 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00404095
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 004040AD
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 004040BE
GetCurrentProcess.KERNEL32(00000000,00000000,IsWow64Process,00000000,GetNativeSystemInfo,kernel32.dll), ref: 004040CD

Strings

IsWow64Process, xrefs: 004040B8
GetNativeSystemInfo, xrefs: 004040A7
kernel32.dll, xrefs: 00404090

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: AddressProc$CurrentHandleModuleProcess
String ID: GetNativeSystemInfo$IsWow64Process$kernel32.dll
API String ID: 977827838-3073145729
Opcode ID: 4fcdc282f5bffe635abf6e5282685a6b48bb5cded201efcccefc7716ffc6b61f
Instruction ID: 0c0e3d299907b3ee1aff85cb762b2a3139cf97807ba38a296252d8d46407c7e6
Opcode Fuzzy Hash: 4fcdc282f5bffe635abf6e5282685a6b48bb5cded201efcccefc7716ffc6b61f
Instruction Fuzzy Hash: 2DF05B7570020472C72066F66C46BDB2A9C8784399F140837B301F21C1E9FDCEC18268

Function 0040D436 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 91COMMON

Download Yara Rule

Strings

value=", xrefs: 0040D4C1, 0040D4D4
<setting name=", xrefs: 0040D483, 0040D499

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID:
String ID: <setting name="$value="
API String ID: 0-3468128162
Opcode ID: d66ce80f9a1f7a768bb22e3579432f9b56c9652e4afbe16f7a293e4c445b665b
Instruction ID: c33e9c415a64bff515884bf69f9fec0b61441930a1e01253635b8b034e8d7c01
Opcode Fuzzy Hash: d66ce80f9a1f7a768bb22e3579432f9b56c9652e4afbe16f7a293e4c445b665b
Instruction Fuzzy Hash: 9E319231D04159AACB11AFE58C42AFEBFF59F19318F144077F800B3291E27D5E849BAA

Function 00401DD2 Relevance: 10.6, APIs: 7, Instructions: 56fileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00401DF3
GetFileSize.KERNEL32(00000001,00000000,?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00401E00
CreateFileMappingA.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00401E14
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000,00000001,00000000,?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00401E29
CloseHandle.KERNEL32(?,00000000,00000004,00000000,00000000,00000000,00000001,00000000,?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00401E38
CloseHandle.KERNEL32(?,?,00000000,00000004,00000000,00000000,00000000,00000001,00000000,?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00401E3F
CloseHandle.KERNEL32(?,00000001,00000000,?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00401E4E

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateExitMappingProcessSizeView
String ID:
API String ID: 3150701006-0
Opcode ID: 949d4fb8c32c1c300465c7b7006e2c22f1bc7f796e9aa28519f762924f610864
Instruction ID: 85007cd7ea39287834dcbb019f2643e60f627f5ec5cda8a57e9b5bd1c9afc158
Opcode Fuzzy Hash: 949d4fb8c32c1c300465c7b7006e2c22f1bc7f796e9aa28519f762924f610864
Instruction Fuzzy Hash: 17115270280311B6EB312F31CC83F493A989B02B58F208577B710BE1E6D6F9A840969C

Function 004082BA Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 190COMMON

Download Yara Rule

Strings

http://, xrefs: 0040847F
ftp://, xrefs: 0040846E
https://, xrefs: 00408490

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID:
String ID: ftp://$http://$https://
API String ID: 0-2804853444
Opcode ID: 824bf21748527ccf0ee5e405d558aa0ac1a34ce766c71e19e7ed342020c2d771
Instruction ID: f252357bb19d0abd475bfb71269b74c2bf29c34e724c4a7a1edd31d425671f1d
Opcode Fuzzy Hash: 824bf21748527ccf0ee5e405d558aa0ac1a34ce766c71e19e7ed342020c2d771
Instruction Fuzzy Hash: DB61F531800109FEDF11AF91CD41AEEBBB9EF50348F00807AB945B51A1DB7A8B95DB98

Function 0040DCE0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

winex=", xrefs: 0040DD2D, 0040DD43
"/>, xrefs: 0040DD52

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID:
String ID: "/>$winex="
API String ID: 0-1498080979
Opcode ID: 3eb132c7603cfba6daa0d9d8a7b522bd3bd9872680de231d3961a307f8acaa4d
Instruction ID: 9434819f4bc3329f6bcbf48870171796baa6cf8dabf0d126b8c2ebfbf643848a
Opcode Fuzzy Hash: 3eb132c7603cfba6daa0d9d8a7b522bd3bd9872680de231d3961a307f8acaa4d
Instruction Fuzzy Hash: 94313B31D04109BACF12ABE1CC029EE7E76AF54348F104037F501B61B2D77E8A55EBA9

Function 00407D4F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 56COMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI(007200D8,FTPCON), ref: 00407D7D
StrStrIA.SHLWAPI(007203F8,FTP CONTROL,00000000,007200D8,FTPCON), ref: 00407D89

Strings

FTPCON, xrefs: 00407D77
\Profiles, xrefs: 00407D9D
.prf, xrefs: 00407DAE
FTP CONTROL, xrefs: 00407D83

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID:
String ID: .prf$FTP CONTROL$FTPCON$\Profiles
API String ID: 0-2908215140
Opcode ID: 3ee4422c411aad379d804a98dde5ede144b823e812d4c7972b1e98bbef3f28bc
Instruction ID: 3a587dd68ddc132e3d47e9ae6ef5358798d7162d4954e74c56b0eb14a8e86de6
Opcode Fuzzy Hash: 3ee4422c411aad379d804a98dde5ede144b823e812d4c7972b1e98bbef3f28bc
Instruction Fuzzy Hash: 6501D23090410579DB112B318D02FBF3E199F41714F24403BB551B22E3E6BC6A92929E

Function 0040F6CE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetHGlobalFromStream.OLE32(?,?,0040F6E3), ref: 0040F6F3
GlobalLock.KERNEL32(?), ref: 0040F714
GlobalUnlock.KERNEL32(?), ref: 0040F72C
StrStrIA.SHLWAPI(00000000,STATUS-IMPORT-OK,?,?,?,0040F6E3), ref: 0040F747

Strings

STATUS-IMPORT-OK, xrefs: 0040F73F

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: Global$FromLockStreamUnlock
String ID: STATUS-IMPORT-OK
API String ID: 2287449323-1591331578
Opcode ID: b6e8bdff3ff7926463861a998b6e19064833c0d612ea786073f2b4296815f8bd
Instruction ID: 60fd6dd111938d6d038ff2f74b19831a1621e6a5a019240cec079445e7f13ed7
Opcode Fuzzy Hash: b6e8bdff3ff7926463861a998b6e19064833c0d612ea786073f2b4296815f8bd
Instruction Fuzzy Hash: 4B016135D04209BBCF112BA2CC829AD7F29AB01348F1041B7B450B65F2DABE9E559B19

Function 00402200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00401BCD: lstrlen.KERNEL32(?), ref: 00401BEE
Part of subcall function 00401BCD: lstrlen.KERNEL32(00000000,?), ref: 00401BF8
Part of subcall function 00401BCD: lstrcpy.KERNEL32(00000000,?), ref: 00401C0C
Part of subcall function 00401BCD: lstrcat.KERNEL32(00000000,00000000), ref: 00401C15

lstrlen.KERNEL32(?), ref: 00402214
StrStrIA.SHLWAPI(00000000,.exe,?), ref: 00402233
StrRChrIA.SHLWAPI(00000000,00000000,0000005C,00000000,.exe,?), ref: 00402245
lstrlen.KERNEL32(00000000,00000000,00000000,0000005C,00000000,.exe,?), ref: 00402257

Strings

.exe, xrefs: 0040222D

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcatlstrcpy
String ID: .exe
API String ID: 2414487701-4119554291
Opcode ID: 7e258b6c382b1638d522e4589bc77b8835f56ee84e5359e788166243c081256f
Instruction ID: 20fea0f44eef862f296ac9e4666e5c2a0ca91eb8a47988185cb6541b9d05db6f
Opcode Fuzzy Hash: 7e258b6c382b1638d522e4589bc77b8835f56ee84e5359e788166243c081256f
Instruction Fuzzy Hash: 92F0AF3160428679DB3272A58C09F6F7E959B83740F2440BBF100AA2D2E7FD984293AD

Function 0040E21C Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

<POP3_Password2, xrefs: 0040E28A, 0040E28F

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID:
String ID: <POP3_Password2
API String ID: 0-2923094552
Opcode ID: b2ededce397b26cab0af6121c7eeb62d9f65699bf69da15e4c12fc532cd8696e
Instruction ID: 3dcf51a08c645b7b89c7da5a563217d878ff6c10a32c66723cc5229c5e5481ec
Opcode Fuzzy Hash: b2ededce397b26cab0af6121c7eeb62d9f65699bf69da15e4c12fc532cd8696e
Instruction Fuzzy Hash: 32412D31D00009EECF12ABA2CD018EEBEB5AF54354F14447BF901B61B1D77A8E61AB69

Function 0040C94D Relevance: 7.6, APIs: 5, Instructions: 79stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?), ref: 0040C97D
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000), ref: 0040C9A3
StrStrIA.SHLWAPI(00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?), ref: 0040C9C7
lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?), ref: 0040C9E9

Part of subcall function 00401752: LocalFree.KERNEL32(00000000,?,004022A7,?,?,?,?,?,?), ref: 0040175E

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?), ref: 0040C9D4

Part of subcall function 00401769: LocalAlloc.KERNEL32(00000040,00402200,?,00402280,?), ref: 00401777

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: ByteCharLocalMultiWidelstrlen$AllocFree
String ID:
API String ID: 1890766102-0
Opcode ID: f09f4bcb1ad51d1da0f405e5d6498c58e5f48926fb0290af68c89bb95b306185
Instruction ID: a379617581106fd5fb9413f6ad87db1a18af527bc8f1d65a3274682b4803367b
Opcode Fuzzy Hash: f09f4bcb1ad51d1da0f405e5d6498c58e5f48926fb0290af68c89bb95b306185
Instruction Fuzzy Hash: 55218E70A00208FEEF21ABE1CC42F9E7F68AB04744F20406BF100BA1E1D7BD5A409B18

Function 004057DD Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI(007203F8,FTP Navigator), ref: 0040580B
StrStrIA.SHLWAPI(007203F8,FTP Commander,007203F8,FTP Navigator), ref: 00405839

Part of subcall function 00402200: lstrlen.KERNEL32(?), ref: 00402214
Part of subcall function 00402200: StrStrIA.SHLWAPI(00000000,.exe,?), ref: 00402233
Part of subcall function 00402200: StrRChrIA.SHLWAPI(00000000,00000000,0000005C,00000000,.exe,?), ref: 00402245
Part of subcall function 00402200: lstrlen.KERNEL32(00000000,00000000,00000000,0000005C,00000000,.exe,?), ref: 00402257

Part of subcall function 00401752: LocalFree.KERNEL32(00000000,?,004022A7,?,?,?,?,?,?), ref: 0040175E

Strings

FTP Navigator, xrefs: 00405805
ftplist.txt, xrefs: 00405820, 0040584E
FTP Commander, xrefs: 00405833

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: lstrlen$FreeLocal
String ID: FTP Commander$FTP Navigator$ftplist.txt
API String ID: 1884169789-2424314702
Opcode ID: 06f67a4a0e3afc5c5b97338d1b9377692534aeb4b7779063e44e602c447dc653
Instruction ID: a94d4ce6a8862bcab918c2400cf106f54a6507ddef4cf3c824bb74ed6eb97003
Opcode Fuzzy Hash: 06f67a4a0e3afc5c5b97338d1b9377692534aeb4b7779063e44e602c447dc653
Instruction Fuzzy Hash: F3010831900105B9DB1137329C02FAF3E19DB41314F24843BB955B22E2D6FC9FA18AAC

Function 0040CBD2 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI(007200D8,FTPNow), ref: 0040CBF9
StrStrIA.SHLWAPI(007200D8,FTP Now,007200D8,FTPNow), ref: 0040CC0A

Strings

FTP Now, xrefs: 0040CC04
FTPNow, xrefs: 0040CBF3
sites.xml, xrefs: 0040CC23

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID:
String ID: FTP Now$FTPNow$sites.xml
API String ID: 0-284577462
Opcode ID: 5a2d900ee459afcd9954fdf8e956b5bf74b060edb0ad68932bc476247c62cd99
Instruction ID: b263a6c4b0789433142b9ec9283812031cf69d713907017c093c2b39616db10d
Opcode Fuzzy Hash: 5a2d900ee459afcd9954fdf8e956b5bf74b060edb0ad68932bc476247c62cd99
Instruction Fuzzy Hash: 87F02670A04005B4EB306B32DD42FAF39655B41784F24023BB518B12E2EABC8F81966C

Function 0040C169 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0040C189
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,00000000,00000000,?,000000FF,00000000,00000000), ref: 0040C1AB
StgOpenStorage.OLE32(?,00000000,00000012,00000000,00000000,?,00000000,00000000,?,000000FF,?,?,?,00000000,00000000,?), ref: 0040C1BF

Strings

Settings, xrefs: 0040C1DC

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$OpenStorage
String ID: Settings
API String ID: 2489594185-473154195
Opcode ID: 1d740487de696f18979e862d4e48132253c9fc08e755ef657b946a443940230f
Instruction ID: 941221d1b5e35f73e9534d79b450400ad248555062b28b39a48171f98e156158
Opcode Fuzzy Hash: 1d740487de696f18979e862d4e48132253c9fc08e755ef657b946a443940230f
Instruction Fuzzy Hash: D031D830A4010AFBDF11AFE1CC42F9EBB76BF04748F20826AB611791F1D6759A50AB58

Function 0040814A Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 110COMMON

Download Yara Rule

Strings

http://, xrefs: 0040819F
https://, xrefs: 004081B0

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID:
String ID: http://$https://
API String ID: 0-1916535328
Opcode ID: 3298a56c5f09f09c3e3e7a8400f1c6da017d87b2c36f94c5f2899de2f956eb9a
Instruction ID: d051175a62bb88a713ec024e39b4392a46a63193600da9ef2a244b006afa0ba2
Opcode Fuzzy Hash: 3298a56c5f09f09c3e3e7a8400f1c6da017d87b2c36f94c5f2899de2f956eb9a
Instruction Fuzzy Hash: 44410631800108FBDF12AF91DE05BEE7B72AF40308F10807AB541791F1CBBA4AA1EB59

Function 004018C1 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004018CB
GetHGlobalFromStream.OLE32(?,?), ref: 004018E4
GlobalLock.KERNEL32(?), ref: 004018FF

Part of subcall function 00401769: LocalAlloc.KERNEL32(00000040,00402200,?,00402280,?), ref: 00401777

GlobalUnlock.KERNEL32(?), ref: 00401927

Part of subcall function 00401752: LocalFree.KERNEL32(00000000,?,004022A7,?,?,?,?,?,?), ref: 0040175E

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: Global$Local$AllocCountFreeFromLockStreamTickUnlock
String ID:
API String ID: 1884134869-0
Opcode ID: 9e8c7c343a3ba8b6e42bcdbf617ef25788879b68666c322fd17dd1257e8940a7
Instruction ID: fa894349ec8e41eab0d0ba830e0c054b9ff2bf07efe50faea15570e3bc294318
Opcode Fuzzy Hash: 9e8c7c343a3ba8b6e42bcdbf617ef25788879b68666c322fd17dd1257e8940a7
Instruction Fuzzy Hash: D621B87590010DBEDF11AFA1CC429DDBF7AEF04348F0040BABA14B51B2DB799B95AB48

Function 0040C80B Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00401548: lstrlen.KERNEL32(00000000), ref: 00401554

StrStrIA.SHLWAPI(?,004136AB), ref: 0040C84A
lstrlen.KERNEL32(TERMSRV/,?,004136AB), ref: 0040C858
StrStrIA.SHLWAPI(?,TERMSRV/,TERMSRV/,?,004136AB), ref: 0040C868

Strings

TERMSRV/, xrefs: 0040C853, 0040C860

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: TERMSRV/
API String ID: 1659193697-3001602198
Opcode ID: f3a8ee6282a4e3f6db9a69a6f5144106a8f0e68b97a36eedc9dc6c6e154e4739
Instruction ID: 06c8ac44936cd5b1fa0ae46afa5e3ea2e95f82a9d9bbb4ca97b0d568c086e9fd
Opcode Fuzzy Hash: f3a8ee6282a4e3f6db9a69a6f5144106a8f0e68b97a36eedc9dc6c6e154e4739
Instruction Fuzzy Hash: EB11A831450109BBCF126FA1CC42CDE3E62AF55359F108536B915752F1D77A8AB1AB88

Function 00408C43 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 00408C56
SetCurrentDirectoryA.KERNEL32(?,?), ref: 00408C77

Strings

nss3.dll, xrefs: 00408C81

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: CurrentDirectorylstrlen
String ID: nss3.dll
API String ID: 2713697268-2492180550
Opcode ID: 8815094c7fd1fd20449cb55087e789c3a84d2a4623d1d5bb4d157efc85b5181e
Instruction ID: f1d91d0dd5899a745220176361581cd3732e4b9ece975038861849ba2aa67b00
Opcode Fuzzy Hash: 8815094c7fd1fd20449cb55087e789c3a84d2a4623d1d5bb4d157efc85b5181e
Instruction Fuzzy Hash: 311182305052419BEB256F20EF0978A3F71BB05348F10813EF406E52F6DFF94865961E

Function 0040C8BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

CredEnumerateA.ADVAPI32(TERMSRV/*,00000000,00000000,00000000), ref: 0040C8FB
CredFree.ADVAPI32(00000000), ref: 0040C942

Strings

TERMSRV/*, xrefs: 0040C8F6

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: Cred$EnumerateFree
String ID: TERMSRV/*
API String ID: 3403564193-275249402
Opcode ID: b28022198875cfa781cfb2bc2165eea29b141934139aa9cb061d4893e741070c
Instruction ID: 294abffb2cfa459f6608875a23fed19a1efe6438d229e5c72e41a04cdb8eb016
Opcode Fuzzy Hash: b28022198875cfa781cfb2bc2165eea29b141934139aa9cb061d4893e741070c
Instruction Fuzzy Hash: 23115E71800204EBDF218F88C848BDEBBB5AF00315F148276D541B12F0D3795A84DB8D

Function 00401C21 Relevance: 5.0, APIs: 4, Instructions: 33stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 00401C42
lstrlen.KERNEL32(00000000,?), ref: 00401C4C
lstrcpy.KERNEL32(00000000,?), ref: 00401C60
lstrcat.KERNEL32(00000000,00000000), ref: 00401C69

Memory Dump Source

Source File: 00000000.00000002.2033101297.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033078812.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033191158.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2qsdqACnX3.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcatlstrcpy
String ID:
API String ID: 2414487701-0
Opcode ID: 9b24d35cd82ca6673d6072b248acc88e076e622046546d064a1723d21eeab292
Instruction ID: 7dc0d747844ad8693d5b3fcbf74b2ff173d7593578b7ac928320faef0b1e46f6
Opcode Fuzzy Hash: 9b24d35cd82ca6673d6072b248acc88e076e622046546d064a1723d21eeab292
Instruction Fuzzy Hash: 84F0177114420CBADF217F62CC85A9D3A69AB11359F10C03BB919291B2D7BDC988DB68

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2qsdqACnX3.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Pony

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\5990015.bat

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Windows Analysis Report
2qsdqACnX3.exe

Function 0040F9DE Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 158
stringCOMMON

Function 0040E785 Relevance: 22.9, APIs: 3, Strings: 10, Instructions: 174
registryCOMMON

Function 0040CFA0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 142
encryptionstringCOMMON

Function 00404A90 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 107
filestringCOMMON

Function 0040421A Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 139
libraryloaderCOMMON

Function 004055C1 Relevance: 36.8, APIs: 3, Strings: 18, Instructions: 76
registryCOMMON

Function 00401E8E Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 172
registrystringCOMMON

Function 004029D6 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82
COMMON

Function 004062AC Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149
registryCOMMON

Function 0040CC54 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 147
registryCOMMON

Function 0040779C Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 146
registryCOMMON

Function 0040D844 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 133
registryCOMMON

Function 00407AEE Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 126
registryCOMMON

Function 004024B2 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 84
registryfileCOMMON

Function 00404C68 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 83
COMMON