Windows Analysis Report
injector V2.5.exe

Overview

General Information

Sample name: injector V2.5.exe
Analysis ID: 1561472
MD5: bcc3a5ac8ca364b58e08a8e771992d6a
SHA1: 36f9ad6f96a2112c5ce71dba2cd87b04f33e6e6a
SHA256: fd0068122528a6a7042dd6301a77067e9675acbddce740e5e85e840d54f98243
Tags: exeuser-4k95m
Infos:

Detection

LummaC Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected LummaC Stealer
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Searches for user specific document files
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

AV Detection
barindex
Found malware configuration
Source: 00000000.00000002.1716566953.0000000002B0E000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: LummaC {"C2 url": ["revirepart.biz"]}
Multi AV Scanner detection for submitted file
Source: injector V2.5.exe ReversingLabs: Detection: 39%
Machine Learning detection for sample
Source: injector V2.5.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: revirepart.biz
Source: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: TeslaBrowser/5.5
Source: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: - Screen Resoluton:
Source: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: - Physical Installed Memory:
Source: 00000002.00000002.1939914379.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: Workgroup: -
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0041A4DA CryptUnprotectData, 2_2_0041A4DA
Uses 32bit PE files
Source: injector V2.5.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 104.21.43.198:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: injector V2.5.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_0060C7DB FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_0060C7DB
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx edi, byte ptr [esp+eax-4E0E29DCh] 2_2_004190D0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov eax, dword ptr [ebp-14h] 2_2_0040B97E
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov edi, eax 2_2_00409AE0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax+74h] 2_2_00409AE0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov byte ptr [edi], dl 2_2_0040DA8D
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h 2_2_00442B00
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov byte ptr [edx], al 2_2_0042F3ED
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx edi, byte ptr [esi+eax+0000009Ch] 2_2_0042E398
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov byte ptr [edx], cl 2_2_0042EB98
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx+74h] 2_2_0040AD50
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx esi, byte ptr [esp+ecx+28421CC0h] 2_2_00442530
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov ebx, esi 2_2_0040C5BE
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then cmp dword ptr [edi+ebp*8], 5B126FE8h 2_2_004427D0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h 2_2_0042D040
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov dl, EAh 2_2_00441860
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov ecx, eax 2_2_0042E06F
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then add eax, dword ptr [esp+ecx*4+30h] 2_2_00407870
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then add eax, dword ptr [esp+edx*4+30h] 2_2_00407870
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov ebx, eax 2_2_00402820
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov byte ptr [eax], dl 2_2_0042D830
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov ecx, eax 2_2_0042E039
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx ebx, byte ptr [esp+esi-3E780BCDh] 2_2_0042A0D5
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov ecx, eax 2_2_0042E007
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx esi, byte ptr [esp+ecx] 2_2_0042B0FA
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx esi, byte ptr [esp+eax+00000148h] 2_2_0040F096
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx esi, byte ptr [esp+eax+00000148h] 2_2_0040F096
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov edi, esi 2_2_004068B0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then cmp dword ptr [edi+ebp*8], A2545BF7h 2_2_00442970
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov dl, EAh 2_2_00441930
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 2_2_004379E0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx edi, byte ptr [esp+ebx+1Ch] 2_2_0040E1EC
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov word ptr [edx], di 2_2_0041FF7F
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h 2_2_00425190
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov word ptr [eax], cx 2_2_0041DA40
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then cmp dword ptr [ecx+esi*8], 4F699CD4h 2_2_00443260
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov di, 0008h 2_2_00404A31
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx edx, byte ptr [eax] 2_2_0043DAC0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx esi, byte ptr [esp+eax+30h] 2_2_0041E2F0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov byte ptr [ecx], al 2_2_0041E2F0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 2_2_0042CAB0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx esi, byte ptr [esp+ecx] 2_2_0042B340
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov word ptr [ebx], cx 2_2_0041EFF5
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then cmp word ptr [ebp+eax+02h], 0000h 2_2_0041EFF5
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then push ebx 2_2_0040C303
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov ecx, eax 2_2_0041BB10
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then cmp word ptr [edx+ecx+02h], 0000h 2_2_0041FB20
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov word ptr [ecx], dx 2_2_0041FB20
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov ecx, eax 2_2_00426BD0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx edx, byte ptr [ebp+eax-00000880h] 2_2_00426BD0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx esi, word ptr [edi] 2_2_00426BD0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov edx, ecx 2_2_00426BD0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then add ebp, dword ptr [esp+0Ch] 2_2_0042D4A0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx eax, byte ptr [esp+edx+2C0C617Eh] 2_2_0041DD48
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx edx, byte ptr [esi+eax+00000404h] 2_2_0042FD65
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov edi, eax 2_2_0042FD65
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov edx, ecx 2_2_00426510
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov esi, ecx 2_2_00429520
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov word ptr [eax], cx 2_2_0040CE52
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx esi, byte ptr [ebx+ecx-18254539h] 2_2_0040CE52
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov ecx, eax 2_2_00426E00
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx edx, byte ptr [ebp+eax-00000880h] 2_2_00426E00
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx esi, word ptr [edi] 2_2_00426E00
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov edx, ecx 2_2_00426E00
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov byte ptr [ecx], dl 2_2_0042DE10
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov eax, edi 2_2_0041F6E0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov ebx, ecx 2_2_0041F6E0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx esi, byte ptr [esp+eax-6032535Eh] 2_2_004296F4
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov ecx, eax 2_2_00426F70
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx edx, byte ptr [ebp+eax-00000880h] 2_2_00426F70
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx esi, word ptr [edi] 2_2_00426F70
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov edx, ecx 2_2_00426F70
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov word ptr [edx], di 2_2_0041FF7F
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then lea ecx, dword ptr [esp+00000A28h] 2_2_0040E714
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov edx, ecx 2_2_0041C7C9
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then cmp dword ptr [edi+esi*8], 1B6183F2h 2_2_0040E7D9
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then mov word ptr [ebx], cx 2_2_0041EFF5
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then cmp word ptr [ebp+eax+02h], 0000h 2_2_0041EFF5
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx edi, byte ptr [esi+eax+0000009Ch] 2_2_0042EF87
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 4x nop then movzx edx, byte ptr [esp+eax-000000D3h] 2_2_0041BFB6

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2057646 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (revirepart .biz) : 192.168.2.4:61706 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057647 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (revirepart .biz in TLS SNI) : 192.168.2.4:49730 -> 104.21.43.198:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 104.21.43.198:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 104.21.43.198:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49738 -> 104.21.88.250:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 104.21.88.250:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 104.21.88.250:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49732 -> 104.21.88.250:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49732 -> 104.21.88.250:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49742 -> 104.21.88.250:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: revirepart.biz
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 104.21.88.250:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 104.21.43.198:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 104.21.88.250:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.88.250:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 104.21.88.250:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 104.21.88.250:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 104.21.88.250:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 104.21.88.250:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 104.21.88.250:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: revirepart.biz
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: frogs-severz.sbs
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 86Host: frogs-severz.sbs
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WMPPQDEMUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18110Host: frogs-severz.sbs
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=GQRL7OYO3CXCHC5RQ4User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8791Host: frogs-severz.sbs
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=L77GLR83TIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20396Host: frogs-severz.sbs
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=HDOQ1XHNTVIKDHFRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1261Host: frogs-severz.sbs
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7TCT4MM8User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1074Host: frogs-severz.sbs
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 121Host: frogs-severz.sbs
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: revirepart.biz
Source: global traffic DNS traffic detected: DNS query: frogs-severz.sbs
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: revirepart.biz
Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: injector V2.5.exe, 00000002.00000003.1839307754.0000000005428000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: injector V2.5.exe, 00000002.00000003.1939838274.00000000053DE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://frogs-severz.sbs/
Source: injector V2.5.exe, 00000002.00000003.1863121105.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1862335417.00000000053DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://frogs-severz.sbs/7P
Source: injector V2.5.exe, 00000002.00000003.1863121105.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1834651944.00000000053DB000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1839575031.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1939838274.00000000053DE000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1834937904.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1862335417.00000000053DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://frogs-severz.sbs/VQ
Source: injector V2.5.exe, injector V2.5.exe, 00000002.00000003.1935433049.0000000002D79000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1914569157.0000000002DEE000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1914478283.0000000002DE1000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1935433049.0000000002D4D000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1865163873.0000000002DE6000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787694380.0000000002DD7000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1866698690.0000000002DEB000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1865220459.0000000002DE9000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1939442013.0000000002D4D000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1935358700.0000000002DE1000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1940531601.0000000002D79000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1940531601.0000000002D4D000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1939442013.0000000002D79000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1940739187.0000000002DE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://frogs-severz.sbs/api
Source: injector V2.5.exe, 00000002.00000003.1914569157.0000000002DEE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://frogs-severz.sbs/apit1
Source: injector V2.5.exe, 00000002.00000003.1935433049.0000000002D79000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1940531601.0000000002D79000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1939442013.0000000002D79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://frogs-severz.sbs/s
Source: injector V2.5.exe, 00000002.00000003.1935433049.0000000002D79000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://frogs-severz.sbs:443/apiBB2B7164E
Source: injector V2.5.exe, 00000002.00000003.1788363210.0000000005431000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.microsof
Source: injector V2.5.exe, 00000002.00000003.1841001230.00000000054F8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: injector V2.5.exe, 00000002.00000003.1841001230.00000000054F8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: injector V2.5.exe, 00000002.00000003.1788447753.0000000005428000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1788363210.000000000542F000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1810691488.0000000005428000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1788551864.0000000005428000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: injector V2.5.exe, 00000002.00000003.1788447753.0000000005403000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: injector V2.5.exe, 00000002.00000003.1788447753.0000000005428000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1788363210.000000000542F000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1810691488.0000000005428000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1788551864.0000000005428000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: injector V2.5.exe, 00000002.00000003.1788447753.0000000005403000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: injector V2.5.exe, 00000002.00000003.1788023368.000000000541A000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1787951787.000000000541C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: injector V2.5.exe, 00000002.00000003.1841001230.00000000054F8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: injector V2.5.exe, 00000002.00000003.1841001230.00000000054F8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: injector V2.5.exe, 00000002.00000003.1841001230.00000000054F8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: injector V2.5.exe, 00000002.00000003.1841001230.00000000054F8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: injector V2.5.exe, 00000002.00000003.1841001230.00000000054F8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown HTTPS traffic detected: 104.21.43.198:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.88.250:443 -> 192.168.2.4:49742 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00435300 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 2_2_00435300
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00435300 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 2_2_00435300
Detected potential crypto function
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_005FF4D0 0_2_005FF4D0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_006034D0 0_2_006034D0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_006015A0 0_2_006015A0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_005FF980 0_2_005FF980
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_005FCE70 0_2_005FCE70
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_005F86C0 0_2_005F86C0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_005FD7F0 0_2_005FD7F0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_00611FD2 0_2_00611FD2
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00429060 2_2_00429060
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00424860 2_2_00424860
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_004190D0 2_2_004190D0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00422110 2_2_00422110
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0043D260 2_2_0043D260
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00409AE0 2_2_00409AE0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0043AAE0 2_2_0043AAE0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0042F3ED 2_2_0042F3ED
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0042E398 2_2_0042E398
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00442C40 2_2_00442C40
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00408C70 2_2_00408C70
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0041A4DA 2_2_0041A4DA
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0040AD50 2_2_0040AD50
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00443580 2_2_00443580
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00426618 2_2_00426618
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0043A760 2_2_0043A760
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00441860 2_2_00441860
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00407870 2_2_00407870
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00423815 2_2_00423815
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0042A0D5 2_2_0042A0D5
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0041E0E8 2_2_0041E0E8
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_004350F0 2_2_004350F0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0042B0FA 2_2_0042B0FA
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0043B0A0 2_2_0043B0A0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0043A0A0 2_2_0043A0A0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_004068B0 2_2_004068B0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0042C14A 2_2_0042C14A
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00441930 2_2_00441930
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_004329C6 2_2_004329C6
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0041FF7F 2_2_0041FF7F
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00425A4A 2_2_00425A4A
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00421250 2_2_00421250
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00443260 2_2_00443260
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00406200 2_2_00406200
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00404A31 2_2_00404A31
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0043DAC0 2_2_0043DAC0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0043E2D0 2_2_0043E2D0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0041E2F0 2_2_0041E2F0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_004332F0 2_2_004332F0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0040B280 2_2_0040B280
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00422360 2_2_00422360
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00402B70 2_2_00402B70
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0041EFF5 2_2_0041EFF5
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0041BB10 2_2_0041BB10
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0041FB20 2_2_0041FB20
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00426BD0 2_2_00426BD0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00431BE8 2_2_00431BE8
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00405BF0 2_2_00405BF0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0041EBF0 2_2_0041EBF0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_004413A0 2_2_004413A0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00425410 2_2_00425410
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00430C1C 2_2_00430C1C
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00420C90 2_2_00420C90
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00406D60 2_2_00406D60
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0042FD65 2_2_0042FD65
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00403570 2_2_00403570
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00429520 2_2_00429520
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_004205F0 2_2_004205F0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_004055F8 2_2_004055F8
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0042B588 2_2_0042B588
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00441597 2_2_00441597
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0041B5A1 2_2_0041B5A1
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00439E40 2_2_00439E40
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00408E50 2_2_00408E50
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0040CE52 2_2_0040CE52
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00426E00 2_2_00426E00
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00432615 2_2_00432615
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0041F6E0 2_2_0041F6E0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_004296F4 2_2_004296F4
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_004096A0 2_2_004096A0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00442F40 2_2_00442F40
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00426F70 2_2_00426F70
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0041FF7F 2_2_0041FF7F
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00404F05 2_2_00404F05
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0043D710 2_2_0043D710
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0041C7C9 2_2_0041C7C9
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_004287D0 2_2_004287D0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0040E7D9 2_2_0040E7D9
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0041EFF5 2_2_0041EFF5
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0042EF87 2_2_0042EF87
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0041BFB6 2_2_0041BFB6
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0042E7BB 2_2_0042E7BB
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_005FF980 2_2_005FF980
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_005FF4D0 2_2_005FF4D0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_006034D0 2_2_006034D0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_006015A0 2_2_006015A0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_005FCE70 2_2_005FCE70
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_005F86C0 2_2_005F86C0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_005FD7F0 2_2_005FD7F0
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00611FD2 2_2_00611FD2
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: String function: 00608178 appears 36 times
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: String function: 004190C0 appears 35 times
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: String function: 004083F0 appears 37 times
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: String function: 006055C0 appears 65 times
Uses 32bit PE files
Source: injector V2.5.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: injector V2.5.exe Static PE information: Section: .coS ZLIB complexity 1.000328100237718
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@4/0@2/2
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0043AAE0 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW, 2_2_0043AAE0
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7024:120:WilError_03
Source: injector V2.5.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\injector V2.5.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: injector V2.5.exe, 00000002.00000003.1788517112.00000000053D5000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1788142973.0000000005407000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: injector V2.5.exe ReversingLabs: Detection: 39%
Source: C:\Users\user\Desktop\injector V2.5.exe File read: C:\Users\user\Desktop\injector V2.5.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\injector V2.5.exe "C:\Users\user\Desktop\injector V2.5.exe"
Source: C:\Users\user\Desktop\injector V2.5.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\injector V2.5.exe Process created: C:\Users\user\Desktop\injector V2.5.exe "C:\Users\user\Desktop\injector V2.5.exe"
Source: C:\Users\user\Desktop\injector V2.5.exe Process created: C:\Users\user\Desktop\injector V2.5.exe "C:\Users\user\Desktop\injector V2.5.exe" Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: injector V2.5.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
PE file contains sections with non-standard names
Source: injector V2.5.exe Static PE information: section name: .00cfg
Source: injector V2.5.exe Static PE information: section name: .coS
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_00604BC5 push ecx; ret 0_2_00604BD8
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_3_02DF9548 push ds; ret 2_3_02DF954A
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_3_02DE6BE0 push esp; retf 2_3_02DE6BEC
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_3_02DE6BE0 push esp; retf 2_3_02DE6BEC
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_3_02DE6BE0 push esp; retf 2_3_02DE6BEC
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_3_02DE6BE0 push esp; retf 2_3_02DE6BEC
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00604BC5 push ecx; ret 2_2_00604BD8
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_00604CA2 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00604CA2
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\injector V2.5.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\Desktop\injector V2.5.exe System information queried: FirmwareTableInformation Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\injector V2.5.exe API coverage: 9.1 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\injector V2.5.exe TID: 6228 Thread sleep time: -210000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe TID: 6228 Thread sleep time: -30000s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\injector V2.5.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_0060C7DB FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_0060C7DB
Source: injector V2.5.exe, 00000002.00000003.1935433049.0000000002D79000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1935433049.0000000002D4D000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1939442013.0000000002D4D000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1940531601.0000000002D79000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1940531601.0000000002D4D000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1939442013.0000000002D79000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: C:\Users\user\Desktop\injector V2.5.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_0043FAC0 LdrInitializeThunk, 2_2_0043FAC0
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_00605444 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00605444
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_005FCD10 mov eax, dword ptr fs:[00000030h] 0_2_005FCD10
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_0061B18D mov edi, dword ptr fs:[00000030h] 0_2_0061B18D
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_005FBD50 mov edi, dword ptr fs:[00000030h] 0_2_005FBD50
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_005FBD50 mov edi, dword ptr fs:[00000030h] 2_2_005FBD50
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_005FCD10 mov eax, dword ptr fs:[00000030h] 2_2_005FCD10
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_00609F90 GetProcessHeap, 0_2_00609F90
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_00605444 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00605444
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_00605438 SetUnhandledExceptionFilter, 0_2_00605438
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_00607DCA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00607DCA
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_00604AD9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00604AD9
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00604AD9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_00604AD9
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00605444 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00605444
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00605438 SetUnhandledExceptionFilter, 2_2_00605438
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 2_2_00607DCA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00607DCA

HIPS / PFW / Operating System Protection Evasion
barindex
Contains functionality to inject code into remote processes
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_0061B18D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread, 0_2_0061B18D
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\injector V2.5.exe Memory written: C:\Users\user\Desktop\injector V2.5.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\injector V2.5.exe Process created: C:\Users\user\Desktop\injector V2.5.exe "C:\Users\user\Desktop\injector V2.5.exe" Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_00605200 cpuid 0_2_00605200
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\injector V2.5.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Code function: 0_2_006058C5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_006058C5
Source: C:\Users\user\Desktop\injector V2.5.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: injector V2.5.exe, 00000002.00000003.1935433049.0000000002D62000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1939442013.0000000002D62000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1940531601.0000000002D62000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\injector V2.5.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: Process Memory Space: injector V2.5.exe PID: 6276, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\FTPbox Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\FTPRush Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Searches for user specific document files
Source: C:\Users\user\Desktop\injector V2.5.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Directory queried: C:\Users\user\Documents\MXPXCVPDVN Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe Directory queried: C:\Users\user\Documents\NEBFQQYWPS Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: injector V2.5.exe PID: 6276, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: Process Memory Space: injector V2.5.exe PID: 6276, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1561472 Sample: injector V2.5.exe Startdate: 23/11/2024 Architecture: WINDOWS Score: 100 16 frogs-severz.sbs 2->16 18 revirepart.biz 2->18 24 Suricata IDS alerts for network traffic 2->24 26 Found malware configuration 2->26 28 Multi AV Scanner detection for submitted file 2->28 30 5 other signatures 2->30 7 injector V2.5.exe 1 2->7         started        signatures3 process4 signatures5 32 Injects a PE file into a foreign processes 7->32 10 injector V2.5.exe 7->10         started        14 conhost.exe 7->14         started        process6 dnsIp7 20 frogs-severz.sbs 104.21.88.250, 443, 49731, 49732 CLOUDFLARENETUS United States 10->20 22 revirepart.biz 104.21.43.198, 443, 49730 CLOUDFLARENETUS United States 10->22 34 Query firmware table information (likely to detect VMs) 10->34 36 Tries to harvest and steal ftp login credentials 10->36 38 Tries to harvest and steal browser information (history, passwords, etc) 10->38 40 Tries to steal Crypto Currency Wallets 10->40 signatures8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.21.43.198
 revirepart.biz United States
13335 CLOUDFLARENETUS false
104.21.88.250
 frogs-severz.sbs United States
13335 CLOUDFLARENETUS true

Contacted Domains

Name IP Active
frogs-severz.sbs 104.21.88.250 true
revirepart.biz 104.21.43.198 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://frogs-severz.sbs/api true
  • Avira URL Cloud: safe
 unknown
https://revirepart.biz/api false
    		high
    revirepart.biz false
      		high