| Analysis Date | 2016-04-23 04:25:34 |
|---|---|
| MD5 | ef92295f915489b7e0d91451959e0cde |
| SHA1 | 3a19576f748a9245799b99eff41c03eeb1802523 |
Static Details:
| File type | PE32 executable for MS Windows (GUI) Intel 80386 32-bit | |
|---|---|---|
| Section | .text md5: 918e234cfddd66d1b64bcba0219276c2 sha1: 0eb7a54da9618b047913fe686c1a4dfcf874237b size: 184832 | |
| Section | .rdata md5: 044ff0e0d59b21ee24714689039a8c14 sha1: 5ced617ca6cb18bcababdc9cb9371ff4ab306549 size: 2560 | |
| Section | .data md5: 6db872b78baea0df36f0f7983bb9f7a4 sha1: 034e5606b61d3acb3a154b149051a753089df57b size: 14848 | |
| Section | .reloc md5: 83deaab6fe045e8c2b33c159fe57e52a sha1: c6e2bc9fc6f3b29f8ce69d390b65f0822ad107a5 size: 30720 | |
| Timestamp | 2014-06-06 14:52:34 | |
| PEhash | 073ec297f7829d6e6c79c47989ba15b75cd504a1 | |
| IMPhash | 909ebcd6d25304ebeb783b183ab28a8e | |
| AV | CA (E-Trust Ino) | Gen:Variant.Razy.15460 |
| AV | Rising | No Virus |
| AV | Mcafee | Trojan-FHQT!EF92295F9154 |
| AV | Avira (antivir) | TR/Nivdort.evwn |
| AV | Twister | No Virus |
| AV | Ad-Aware | Gen:Variant.Razy.15460 |
| AV | Alwil (avast) | Evo-gen [Susp] |
| AV | Eset (nod32) | Win32/Bayrob.BA |
| AV | Grisoft (avg) | No Virus |
| AV | Symantec | Trojan.Bayrob!gen6 |
| AV | Fortinet | W32/Bayrob.AQ!tr |
| AV | BitDefender | Gen:Variant.Razy.15460 |
| AV | K7 | Trojan ( 004dc2a31 ) |
| AV | Microsoft Security Essentials | TrojanSpy:Win32/Nivdort.DE |
| AV | MicroWorld (escan) | Gen:Variant.Razy.15460 |
| AV | MalwareBytes | No Virus |
| AV | Authentium | W32/Nivdort.G.gen!Eldorado |
| AV | Frisk (f-prot) | W32/Nivdort.G.gen!Eldorado |
| AV | Ikarus | Trojan.Win32.Bayrob |
| AV | Emsisoft | Gen:Variant.Razy.15460 |
| AV | Zillya! | No Virus |
| AV | Kaspersky | Trojan.Win32.Generic |
| AV | Trend Micro | No Virus |
| AV | CAT (quickheal) | TrojanSpy.Nivdort.WR4 |
| AV | VirusBlokAda (vba32) | No Virus |
| AV | BullGuard | Gen:Variant.Razy.15460 |
| AV | Arcabit (arcavir) | Gen:Variant.Razy.15460 |
| AV | ClamAV | No Virus |
| AV | Dr. Web | No Virus |
| AV | F-Secure | Gen:Variant.Razy.15460 |
Runtime Details:
| Screenshot |  |
|---|
Process
↳ C:\malware.exe
| Creates File | C:\btfxqhfbymvhp\md1m1eedsfmevczqb.exe |
|---|---|
| Creates File | C:\WINDOWS\btfxqhfbymvhp\onhz7olier |
| Creates File | C:\btfxqhfbymvhp\onhz7olier |
| Deletes File | C:\WINDOWS\btfxqhfbymvhp\onhz7olier |
| Creates Process | C:\btfxqhfbymvhp\md1m1eedsfmevczqb.exe |
Process
↳ C:\btfxqhfbymvhp\md1m1eedsfmevczqb.exe
| Registry | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NGEN Isolation SNMP PNRP Removal ➝ C:\btfxqhfbymvhp\xlmbyinrlzi.exe |
|---|---|
| Creates File | C:\WINDOWS\btfxqhfbymvhp\onhz7olier |
| Creates File | C:\btfxqhfbymvhp\xlmbyinrlzi.exe |
| Creates File | PIPE\lsarpc |
| Creates File | C:\btfxqhfbymvhp\onhz7olier |
| Creates File | C:\btfxqhfbymvhp\axqcnfyspdc |
| Deletes File | C:\WINDOWS\btfxqhfbymvhp\onhz7olier |
| Creates Process | C:\btfxqhfbymvhp\xlmbyinrlzi.exe |
| Creates Service | Gateway Foundation Routing - C:\btfxqhfbymvhp\xlmbyinrlzi.exe |
Process
↳ Pid 800
Process
↳ Pid 848
Process
↳ C:\WINDOWS\System32\svchost.exe
| Creates File | pipe\PCHFaultRepExecPipe |
|---|
Process
↳ Pid 1128
Process
↳ Pid 1204
Process
↳ C:\WINDOWS\system32\spoolsv.exe
Process
↳ Pid 1872
Process
↳ Pid 1148
Process
↳ C:\btfxqhfbymvhp\xlmbyinrlzi.exe
| Creates File | C:\btfxqhfbymvhp\dolcom |
|---|---|
| Creates File | C:\WINDOWS\btfxqhfbymvhp\onhz7olier |
| Creates File | pipe\net\NtControlPipe10 |
| Creates File | C:\btfxqhfbymvhp\onhz7olier |
| Creates File | \Device\Afd\Endpoint |
| Creates File | C:\btfxqhfbymvhp\ofvfkgkpg.exe |
| Creates File | C:\btfxqhfbymvhp\axqcnfyspdc |
| Deletes File | C:\WINDOWS\btfxqhfbymvhp\onhz7olier |
| Creates Process | fj1tuzfosuzw "c:\btfxqhfbymvhp\xlmbyinrlzi.exe" |
Process
↳ C:\btfxqhfbymvhp\xlmbyinrlzi.exe
| Creates File | C:\WINDOWS\btfxqhfbymvhp\onhz7olier |
|---|---|
| Creates File | C:\btfxqhfbymvhp\onhz7olier |
| Deletes File | C:\WINDOWS\btfxqhfbymvhp\onhz7olier |
Process
↳ fj1tuzfosuzw "c:\btfxqhfbymvhp\xlmbyinrlzi.exe"
| Creates File | C:\WINDOWS\btfxqhfbymvhp\onhz7olier |
|---|---|
| Creates File | C:\btfxqhfbymvhp\onhz7olier |
| Deletes File | C:\WINDOWS\btfxqhfbymvhp\onhz7olier |
Network Details:
| DNS | nightstation.net Type: A 69.163.152.49 |
|---|---|
| DNS | electricstation.net Type: A 50.63.202.37 |
| DNS | tradestation.net Type: A 65.211.211.21 |
| DNS | breadstation.net Type: A 208.100.26.234 |
| DNS | breadchildhood.net Type: A 195.22.28.196 |
| DNS | breadchildhood.net Type: A 195.22.28.197 |
| DNS | breadchildhood.net Type: A 195.22.28.199 |
| DNS | breadchildhood.net Type: A 195.22.28.198 |
| DNS | nightspace.net Type: A 91.250.101.43 |
| DNS | largespace.net Type: A 62.22.102.59 |
| DNS | captainspace.net Type: A 208.100.26.234 |
| DNS | captaintravel.net Type: A 184.168.221.96 |
| DNS | recordspace.net Type: A 122.9.227.77 |
| DNS | streetspace.net Type: A 208.91.197.132 |
| DNS | tradespace.net Type: A 207.148.248.143 |
| DNS | streettravel.net Type: A 104.27.131.181 |
| DNS | streettravel.net Type: A 104.27.130.181 |
| DNS | betterspace.net Type: A 208.73.211.183 |
| DNS | betterspace.net Type: A 208.73.211.192 |
| DNS | betterspace.net Type: A 208.73.211.179 |
| DNS | betterspace.net Type: A 208.73.211.195 |
| DNS | gatherspace.net Type: A 216.157.91.112 |
| DNS | bettertravel.net Type: A 207.148.248.143 |
| DNS | breadspace.net Type: A 5.2.189.251 |
| DNS | thinkbeyond.net Type: A 207.148.248.143 |
| DNS | presentbeing.net Type: A 69.16.192.64 |
| DNS | thinkbottom.net Type: A 208.100.26.234 |
| DNS | chiefbeyond.net Type: A 195.22.28.196 |
| DNS | chiefbeyond.net Type: A 195.22.28.198 |
| DNS | chiefbeyond.net Type: A 195.22.28.199 |
| DNS | chiefbeyond.net Type: A 195.22.28.197 |
| DNS | twelveforever.net Type: A 157.166.173.157 |
| DNS | ratherforever.net Type: A 208.100.26.234 |
| DNS | seasondemand.net Type: A |
| DNS | quietshout.net Type: A |
| DNS | seasonshout.net Type: A |
| DNS | againststation.net Type: A |
| DNS | doubtstation.net Type: A |
| DNS | againstthird.net Type: A |
| DNS | doubtthird.net Type: A |
| DNS | againstobject.net Type: A |
| DNS | doubtobject.net Type: A |
| DNS | againstchildhood.net Type: A |
| DNS | doubtchildhood.net Type: A |
| DNS | decidestation.net Type: A |
| DNS | nightthird.net Type: A |
| DNS | decidethird.net Type: A |
| DNS | nightobject.net Type: A |
| DNS | decideobject.net Type: A |
| DNS | nightchildhood.net Type: A |
| DNS | decidechildhood.net Type: A |
| DNS | largestation.net Type: A |
| DNS | captainstation.net Type: A |
| DNS | largethird.net Type: A |
| DNS | captainthird.net Type: A |
| DNS | largeobject.net Type: A |
| DNS | captainobject.net Type: A |
| DNS | largechildhood.net Type: A |
| DNS | captainchildhood.net Type: A |
| DNS | recordstation.net Type: A |
| DNS | recordthird.net Type: A |
| DNS | electricthird.net Type: A |
| DNS | recordobject.net Type: A |
| DNS | electricobject.net Type: A |
| DNS | recordchildhood.net Type: A |
| DNS | electricchildhood.net Type: A |
| DNS | streetstation.net Type: A |
| DNS | streetthird.net Type: A |
| DNS | tradethird.net Type: A |
| DNS | streetobject.net Type: A |
| DNS | tradeobject.net Type: A |
| DNS | streetchildhood.net Type: A |
| DNS | tradechildhood.net Type: A |
| DNS | betterstation.net Type: A |
| DNS | gatherstation.net Type: A |
| DNS | betterthird.net Type: A |
| DNS | gatherthird.net Type: A |
| DNS | betterobject.net Type: A |
| DNS | gatherobject.net Type: A |
| DNS | betterchildhood.net Type: A |
| DNS | gatherchildhood.net Type: A |
| DNS | flierstation.net Type: A |
| DNS | flierthird.net Type: A |
| DNS | breadthird.net Type: A |
| DNS | flierobject.net Type: A |
| DNS | breadobject.net Type: A |
| DNS | flierchildhood.net Type: A |
| DNS | quietstation.net Type: A |
| DNS | seasonstation.net Type: A |
| DNS | quietthird.net Type: A |
| DNS | seasonthird.net Type: A |
| DNS | quietobject.net Type: A |
| DNS | seasonobject.net Type: A |
| DNS | quietchildhood.net Type: A |
| DNS | seasonchildhood.net Type: A |
| DNS | againstspace.net Type: A |
| DNS | doubtspace.net Type: A |
| DNS | againsttravel.net Type: A |
| DNS | doubttravel.net Type: A |
| DNS | againstyellow.net Type: A |
| DNS | doubtyellow.net Type: A |
| DNS | againstclose.net Type: A |
| DNS | doubtclose.net Type: A |
| DNS | decidespace.net Type: A |
| DNS | nighttravel.net Type: A |
| DNS | decidetravel.net Type: A |
| DNS | nightyellow.net Type: A |
| DNS | decideyellow.net Type: A |
| DNS | nightclose.net Type: A |
| DNS | decideclose.net Type: A |
| DNS | largetravel.net Type: A |
| DNS | largeyellow.net Type: A |
| DNS | captainyellow.net Type: A |
| DNS | largeclose.net Type: A |
| DNS | captainclose.net Type: A |
| DNS | electricspace.net Type: A |
| DNS | recordtravel.net Type: A |
| DNS | electrictravel.net Type: A |
| DNS | recordyellow.net Type: A |
| DNS | electricyellow.net Type: A |
| DNS | recordclose.net Type: A |
| DNS | electricclose.net Type: A |
| DNS | tradetravel.net Type: A |
| DNS | streetyellow.net Type: A |
| DNS | tradeyellow.net Type: A |
| DNS | streetclose.net Type: A |
| DNS | tradeclose.net Type: A |
| DNS | gathertravel.net Type: A |
| DNS | betteryellow.net Type: A |
| DNS | gatheryellow.net Type: A |
| DNS | betterclose.net Type: A |
| DNS | gatherclose.net Type: A |
| DNS | flierspace.net Type: A |
| DNS | fliertravel.net Type: A |
| DNS | breadtravel.net Type: A |
| DNS | flieryellow.net Type: A |
| DNS | breadyellow.net Type: A |
| DNS | flierclose.net Type: A |
| DNS | breadclose.net Type: A |
| DNS | quietspace.net Type: A |
| DNS | seasonspace.net Type: A |
| DNS | quiettravel.net Type: A |
| DNS | seasontravel.net Type: A |
| DNS | quietyellow.net Type: A |
| DNS | seasonyellow.net Type: A |
| DNS | quietclose.net Type: A |
| DNS | seasonclose.net Type: A |
| DNS | presentbeyond.net Type: A |
| DNS | thinkbeing.net Type: A |
| DNS | thinkforever.net Type: A |
| DNS | presentforever.net Type: A |
| DNS | presentbottom.net Type: A |
| DNS | collegebeyond.net Type: A |
| DNS | chiefbeing.net Type: A |
| DNS | collegebeing.net Type: A |
| DNS | chiefforever.net Type: A |
| DNS | collegeforever.net Type: A |
| DNS | chiefbottom.net Type: A |
| DNS | collegebottom.net Type: A |
| DNS | oftenbeyond.net Type: A |
| DNS | alonebeyond.net Type: A |
| DNS | oftenbeing.net Type: A |
| DNS | alonebeing.net Type: A |
| DNS | oftenforever.net Type: A |
| DNS | aloneforever.net Type: A |
| DNS | oftenbottom.net Type: A |
| DNS | alonebottom.net Type: A |
| DNS | middlebeyond.net Type: A |
| DNS | twelvebeyond.net Type: A |
| DNS | middlebeing.net Type: A |
| DNS | twelvebeing.net Type: A |
| DNS | middleforever.net Type: A |
| DNS | middlebottom.net Type: A |
| DNS | twelvebottom.net Type: A |
| DNS | ratherbeyond.net Type: A |
| DNS | morningbeyond.net Type: A |
| DNS | ratherbeing.net Type: A |
| DNS | morningbeing.net Type: A |
| DNS | morningforever.net Type: A |
| DNS | ratherbottom.net Type: A |
| HTTP GET | http://nightstation.net/index.php User-Agent: |
| HTTP GET | http://electricstation.net/index.php User-Agent: |
| HTTP GET | http://tradestation.net/index.php User-Agent: |
| HTTP GET | http://breadstation.net/index.php User-Agent: |
| HTTP GET | http://breadchildhood.net/index.php User-Agent: |
| HTTP GET | http://nightspace.net/index.php User-Agent: |
| HTTP GET | http://largespace.net/index.php User-Agent: |
| HTTP GET | http://captainspace.net/index.php User-Agent: |
| HTTP GET | http://captaintravel.net/index.php User-Agent: |
| HTTP GET | http://recordspace.net/index.php User-Agent: |
| HTTP GET | http://streetspace.net/index.php User-Agent: |
| HTTP GET | http://tradespace.net/index.php User-Agent: |
| HTTP GET | http://streettravel.net/index.php User-Agent: |
| HTTP GET | http://betterspace.net/index.php User-Agent: |
| HTTP GET | http://gatherspace.net/index.php User-Agent: |
| HTTP GET | http://bettertravel.net/index.php User-Agent: |
| HTTP GET | http://breadspace.net/index.php User-Agent: |
| HTTP GET | http://thinkbeyond.net/index.php User-Agent: |
| HTTP GET | http://presentbeing.net/index.php User-Agent: |
| HTTP GET | http://thinkbottom.net/index.php User-Agent: |
| HTTP GET | http://chiefbeyond.net/index.php User-Agent: |
| HTTP GET | http://twelveforever.net/index.php User-Agent: |
| HTTP GET | http://ratherforever.net/index.php User-Agent: |
| Flows TCP | 192.168.1.1:1031 ➝ 69.163.152.49:80 |
| Flows TCP | 192.168.1.1:1032 ➝ 50.63.202.37:80 |
| Flows TCP | 192.168.1.1:1033 ➝ 65.211.211.21:80 |
| Flows TCP | 192.168.1.1:1034 ➝ 208.100.26.234:80 |
| Flows TCP | 192.168.1.1:1035 ➝ 195.22.28.196:80 |
| Flows TCP | 192.168.1.1:1036 ➝ 91.250.101.43:80 |
| Flows TCP | 192.168.1.1:1037 ➝ 62.22.102.59:80 |
| Flows TCP | 192.168.1.1:1038 ➝ 208.100.26.234:80 |
| Flows TCP | 192.168.1.1:1039 ➝ 184.168.221.96:80 |
| Flows TCP | 192.168.1.1:1040 ➝ 122.9.227.77:80 |
| Flows TCP | 192.168.1.1:1041 ➝ 208.91.197.132:80 |
| Flows TCP | 192.168.1.1:1042 ➝ 207.148.248.143:80 |
| Flows TCP | 192.168.1.1:1043 ➝ 104.27.131.181:80 |
| Flows TCP | 192.168.1.1:1044 ➝ 208.73.211.183:80 |
| Flows TCP | 192.168.1.1:1045 ➝ 216.157.91.112:80 |
| Flows TCP | 192.168.1.1:1046 ➝ 207.148.248.143:80 |
| Flows TCP | 192.168.1.1:1047 ➝ 5.2.189.251:80 |
| Flows TCP | 192.168.1.1:1048 ➝ 207.148.248.143:80 |
| Flows TCP | 192.168.1.1:1049 ➝ 69.16.192.64:80 |
| Flows TCP | 192.168.1.1:1050 ➝ 208.100.26.234:80 |
| Flows TCP | 192.168.1.1:1051 ➝ 195.22.28.196:80 |
| Flows TCP | 192.168.1.1:1052 ➝ 157.166.173.157:80 |
| Flows TCP | 192.168.1.1:1053 ➝ 208.100.26.234:80 |
Raw Pcap
Strings