8de41ace...fe11

VTI SCORE: 98/100

Target:

win7_32_sp1 | exe

Classification:

Trojan, Spyware, Downloader

8de41ace64ef22a1c4755070befebf33082bee0ab6f3a236654937f6d56bfe11 (SHA256)

3838612080743901967.exe

Windows Exe (x86-32)

Created at 2018-04-11 09:22:00

Severity	Category	Operation	Classification
4/5	User	Brute-forces user account	Spyware
Possibly trying to brute-force the "Guest" account. ... VTI Actions Go to Function Call
Possibly trying to brute-force the "Administrator" account. ... VTI Actions Go to Function Call
4/5	File System	Associated with malicious files	Trojan
File "c:\users\eebsym5\appdata\local\temp\18144644.bat" is a known malicious file. ... VTI Actions Go to File Details Go to Function Call
3/5	Browser	Reads data related to saved browser credentials	-
Reads saved credentials for "Google Chrome". ... VTI Actions Go to Function Call
2/5	Network	Associated with known malicious/suspicious URLs	-
URL "tnaapparels.com/44/panel/gate.php" is known as malicious URL. ... VTI Actions Go to Function Call
URL "tnaapparels.com/44/panel/44.exe" is known as malicious URL. ... VTI Actions Go to Function Call
1/5	Anti Analysis	Tries to detect debugger	-
Check via API "NtQueryInformationProcess". ... VTI Actions Go to Function Call
1/5	Process	Creates process with hidden window	-
The process ""C:\Users\EEBsYm5\Desktop\3838612080743901967.exe" " starts with hidden window. ... VTI Actions Go to Function Call
The process "C:\Users\EEBsYm5\AppData\Local\Temp\18144644.bat" starts with hidden window. ... VTI Actions Go to Function Call
1/5	Anti Analysis	Resolves APIs dynamically to possibly evade static detection	-
Resolves an unusually high number of APIs. ... VTI Actions Go to Function Call
1/5	Network	Performs DNS request	-
Resolves host name "tnaapparels.com". ... VTI Actions Go to Function Call
1/5	Injection	Writes into the memory of a process running from a created or modified executable	-
"c:\users\eebsym5\desktop\3838612080743901967.exe" modifies memory of "c:\users\eebsym5\desktop\3838612080743901967.exe" ... VTI Actions Go to Function Call
1/5	Injection	Modifies control flow of a process running from a created or modified executable	-
"c:\users\eebsym5\desktop\3838612080743901967.exe" alters context of "c:\users\eebsym5\desktop\3838612080743901967.exe" ... VTI Actions Go to Function Call
1/5	Network	Connects to remote host	-
Outgoing TCP connection to host "192.95.7.159:80". ... VTI Actions Go to Function Call
1/5	Network	Downloads data	Downloader
URL "tnaapparels.com/44/panel/gate.php". ... VTI Actions Go to Function Call
1/5	Network	Connects to HTTP server	-
URL "tnaapparels.com/44/panel/gate.php". ... VTI Actions Go to Function Call
URL "tnaapparels.com/44/panel/44.exe". ... VTI Actions Go to Function Call

Function Logfile

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".

Before

After