Analysis Date2016-02-08 15:14:36
MD5b233d67445791c30868cc1795fadc6c7
SHA16c0f6955928df0cbbda830e3bec2960670316804

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 4c52f15e8ba74731fc0092dbe75315d0 sha1: bf3b500da971ed00260ac3fb17264e8b6652fcfe size: 217088
Section.rdata md5: 7b89ad4ee2618a877c314347f682f5fc sha1: eaeab43899366c6eb0d1dd49279edae80cff6d04 size: 18944
Section.data md5: 07b5472d347d42780469fb2654b7fc54 sha1: 943ae54f4818e52409fbbaf60ffd71318d966b0d size: 512
Section.reloc md5: 959d85e50bffb49b522c1ed804e491c4 sha1: 6a21b28238bd06f11d6131c701e56b3e803f60b6 size: 40960
Timestamp2016-01-03 13:47:46
PEhash8a8e8cd28559a390d4fe83a377662dbd69d6314a
IMPhash81df9c9efcd8bfadf6ff4c2907fd8a04
AVCA (E-Trust Ino)Gen:Variant.Razy.12226
AVRisingNo Virus
AVMcafeeTrojan-FHOH!B233D6744579
AVAvira (antivir)TR/Crypt.Xpack.444040
AVTwisterNo Virus
AVAd-AwareGen:Variant.Razy.12226
AVAlwil (avast)Win32:Malware-gen
AVEset (nod32)Win32/Bayrob.AT.gen
AVGrisoft (avg)Win32/Heur
AVSymantecTrojan.Bayrob!gen6
AVFortinetW32/Bayrob.AQ!tr
AVBitDefenderGen:Variant.Razy.12226
AVK7Trojan ( 004db0c61 )
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort.DD
AVMicroWorld (escan)Gen:Variant.Razy.12226
AVMalwareBytesNo Virus
AVAuthentiumW32/BayRob.D.gen!Eldorado
AVEmsisoftGen:Variant.Razy.12226
AVFrisk (f-prot)W32/BayRob.D.gen!Eldorado
AVIkarusTrojan.Win32.Bayrob
AVZillya!Trojan.Bayrob.Win32.13308
AVKasperskyTrojan.Win32.Bayrob.gid
AVTrend MicroNo Virus
AVVirusBlokAda (vba32)No Virus
AVCAT (quickheal)No Virus
AVBullGuardGen:Variant.Razy.12226
AVArcabit (arcavir)Gen:Variant.Razy.12226
AVClamAVNo Virus
AVDr. WebNo Virus
AVF-SecureGen:Variant.Razy.12226

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\dasxifbrhongxn\sxu1o6amummd
Creates FileC:\WINDOWS\dasxifbrhongxn\sxu1o6amummd
Creates FileC:\dasxifbrhongxn\m4c1klbdlawmged.exe
Deletes FileC:\WINDOWS\dasxifbrhongxn\sxu1o6amummd
Creates ProcessC:\dasxifbrhongxn\m4c1klbdlawmged.exe

Process
↳ C:\dasxifbrhongxn\m4c1klbdlawmged.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Trap Grouping DLL Brightness Studio Resolution ➝
C:\dasxifbrhongxn\atizoyix.exe
Creates FileC:\dasxifbrhongxn\atizoyix.exe
Creates FileC:\dasxifbrhongxn\sxu1o6amummd
Creates FileC:\WINDOWS\dasxifbrhongxn\sxu1o6amummd
Creates FileC:\dasxifbrhongxn\pcnfiglme
Creates FilePIPE\lsarpc
Deletes FileC:\WINDOWS\dasxifbrhongxn\sxu1o6amummd
Creates ProcessC:\dasxifbrhongxn\atizoyix.exe
Creates ServiceAdaptive Manager Discovery - C:\dasxifbrhongxn\atizoyix.exe

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ Pid 808

Process
↳ Pid 852

Process
↳ C:\WINDOWS\System32\svchost.exe

Creates FileC:\WINDOWS\system32\WBEM\Logs\wbemess.log

Process
↳ Pid 1208

Process
↳ C:\WINDOWS\system32\spoolsv.exe

Process
↳ Pid 1844

Process
↳ Pid 1132

Process
↳ C:\dasxifbrhongxn\atizoyix.exe

Creates FileC:\dasxifbrhongxn\oabeifsyarne.exe
Creates FileC:\dasxifbrhongxn\sxu1o6amummd
Creates FileC:\WINDOWS\dasxifbrhongxn\sxu1o6amummd
Creates Filepipe\net\NtControlPipe10
Creates FileC:\dasxifbrhongxn\pcnfiglme
Creates File\Device\Afd\Endpoint
Creates FileC:\dasxifbrhongxn\yekwnjza
Deletes FileC:\WINDOWS\dasxifbrhongxn\sxu1o6amummd
Creates Processk6dyxiun0rm8 "c:\dasxifbrhongxn\atizoyix.exe"

Process
↳ C:\dasxifbrhongxn\atizoyix.exe

Creates FileC:\dasxifbrhongxn\sxu1o6amummd
Creates FileC:\WINDOWS\dasxifbrhongxn\sxu1o6amummd
Deletes FileC:\WINDOWS\dasxifbrhongxn\sxu1o6amummd

Process
↳ k6dyxiun0rm8 "c:\dasxifbrhongxn\atizoyix.exe"

Creates FileC:\dasxifbrhongxn\sxu1o6amummd
Creates FileC:\WINDOWS\dasxifbrhongxn\sxu1o6amummd
Deletes FileC:\WINDOWS\dasxifbrhongxn\sxu1o6amummd

Network Details:

DNSpartybottle.net
Type: A
91.215.216.53
DNSfightbottle.net
Type: A
195.22.28.196
DNSfightbottle.net
Type: A
195.22.28.197
DNSfightbottle.net
Type: A
195.22.28.198
DNSfightbottle.net
Type: A
195.22.28.199
DNSfreshbusiness.net
Type: A
72.52.4.120
DNSexperiencebusiness.net
Type: A
188.40.135.139
DNSfollowappear.net
Type: A
208.100.26.234
DNSsummerbusiness.net
Type: A
8.5.1.46
DNScrowdbusiness.net
Type: A
72.52.4.91
DNSwaterbusiness.net
Type: A
192.185.77.17
DNSwomanbusiness.net
Type: A
184.168.221.52
DNSpartybusiness.net
Type: A
50.62.253.1
DNSmelbourneit.hotkeysparking.com
Type: A
8.5.1.16
DNSthoughtexplain.net
Type: A
208.100.26.234
DNSsmokeinside.net
Type: A
50.63.202.34
DNSpartybright.net
Type: A
50.63.202.44
DNSknownpeople.net
Type: A
50.30.43.150
DNSsummerready.net
Type: A
198.71.232.3
DNSsummerpeople.net
Type: A
65.254.248.141
DNSfightnothing.net
Type: A
DNSpartydivide.net
Type: A
DNSfightdivide.net
Type: A
DNSfreshmanner.net
Type: A
DNSexperiencemanner.net
Type: A
DNSfreshanother.net
Type: A
DNSexperienceanother.net
Type: A
DNSfreshappear.net
Type: A
DNSexperienceappear.net
Type: A
DNSgentlemanmanner.net
Type: A
DNSalreadymanner.net
Type: A
DNSgentlemananother.net
Type: A
DNSalreadyanother.net
Type: A
DNSgentlemanbusiness.net
Type: A
DNSalreadybusiness.net
Type: A
DNSgentlemanappear.net
Type: A
DNSalreadyappear.net
Type: A
DNSfollowmanner.net
Type: A
DNSmembermanner.net
Type: A
DNSfollowanother.net
Type: A
DNSmemberanother.net
Type: A
DNSfollowbusiness.net
Type: A
DNSmemberbusiness.net
Type: A
DNSmemberappear.net
Type: A
DNSbeginmanner.net
Type: A
DNSknownmanner.net
Type: A
DNSbeginanother.net
Type: A
DNSknownanother.net
Type: A
DNSbeginbusiness.net
Type: A
DNSknownbusiness.net
Type: A
DNSbeginappear.net
Type: A
DNSknownappear.net
Type: A
DNSsummermanner.net
Type: A
DNScrowdmanner.net
Type: A
DNSsummeranother.net
Type: A
DNScrowdanother.net
Type: A
DNSsummerappear.net
Type: A
DNScrowdappear.net
Type: A
DNSthoughtmanner.net
Type: A
DNSwatermanner.net
Type: A
DNSthoughtanother.net
Type: A
DNSwateranother.net
Type: A
DNSthoughtbusiness.net
Type: A
DNSthoughtappear.net
Type: A
DNSwaterappear.net
Type: A
DNSwomanmanner.net
Type: A
DNSsmokemanner.net
Type: A
DNSwomananother.net
Type: A
DNSsmokeanother.net
Type: A
DNSsmokebusiness.net
Type: A
DNSwomanappear.net
Type: A
DNSsmokeappear.net
Type: A
DNSpartymanner.net
Type: A
DNSfightmanner.net
Type: A
DNSpartyanother.net
Type: A
DNSfightanother.net
Type: A
DNSfightbusiness.net
Type: A
DNSpartyappear.net
Type: A
DNSfightappear.net
Type: A
DNSfreshinstead.net
Type: A
DNSexperienceinstead.net
Type: A
DNSfreshexplain.net
Type: A
DNSexperienceexplain.net
Type: A
DNSfreshbright.net
Type: A
DNSexperiencebright.net
Type: A
DNSfreshinside.net
Type: A
DNSexperienceinside.net
Type: A
DNSgentlemaninstead.net
Type: A
DNSalreadyinstead.net
Type: A
DNSgentlemanexplain.net
Type: A
DNSalreadyexplain.net
Type: A
DNSgentlemanbright.net
Type: A
DNSalreadybright.net
Type: A
DNSgentlemaninside.net
Type: A
DNSalreadyinside.net
Type: A
DNSfollowinstead.net
Type: A
DNSmemberinstead.net
Type: A
DNSfollowexplain.net
Type: A
DNSmemberexplain.net
Type: A
DNSfollowbright.net
Type: A
DNSmemberbright.net
Type: A
DNSfollowinside.net
Type: A
DNSmemberinside.net
Type: A
DNSbegininstead.net
Type: A
DNSknowninstead.net
Type: A
DNSbeginexplain.net
Type: A
DNSknownexplain.net
Type: A
DNSbeginbright.net
Type: A
DNSknownbright.net
Type: A
DNSbegininside.net
Type: A
DNSknowninside.net
Type: A
DNSsummerinstead.net
Type: A
DNScrowdinstead.net
Type: A
DNSsummerexplain.net
Type: A
DNScrowdexplain.net
Type: A
DNSsummerbright.net
Type: A
DNScrowdbright.net
Type: A
DNSsummerinside.net
Type: A
DNScrowdinside.net
Type: A
DNSthoughtinstead.net
Type: A
DNSwaterinstead.net
Type: A
DNSwaterexplain.net
Type: A
DNSthoughtbright.net
Type: A
DNSwaterbright.net
Type: A
DNSthoughtinside.net
Type: A
DNSwaterinside.net
Type: A
DNSwomaninstead.net
Type: A
DNSsmokeinstead.net
Type: A
DNSwomanexplain.net
Type: A
DNSsmokeexplain.net
Type: A
DNSwomanbright.net
Type: A
DNSsmokebright.net
Type: A
DNSwomaninside.net
Type: A
DNSpartyinstead.net
Type: A
DNSfightinstead.net
Type: A
DNSpartyexplain.net
Type: A
DNSfightexplain.net
Type: A
DNSfightbright.net
Type: A
DNSpartyinside.net
Type: A
DNSfightinside.net
Type: A
DNSfreshready.net
Type: A
DNSexperienceready.net
Type: A
DNSfreshbrown.net
Type: A
DNSexperiencebrown.net
Type: A
DNSfreshpeople.net
Type: A
DNSexperiencepeople.net
Type: A
DNSfreshdaughter.net
Type: A
DNSexperiencedaughter.net
Type: A
DNSgentlemanready.net
Type: A
DNSalreadyready.net
Type: A
DNSgentlemanbrown.net
Type: A
DNSalreadybrown.net
Type: A
DNSgentlemanpeople.net
Type: A
DNSalreadypeople.net
Type: A
DNSgentlemandaughter.net
Type: A
DNSalreadydaughter.net
Type: A
DNSfollowready.net
Type: A
DNSmemberready.net
Type: A
DNSfollowbrown.net
Type: A
DNSmemberbrown.net
Type: A
DNSfollowpeople.net
Type: A
DNSmemberpeople.net
Type: A
DNSfollowdaughter.net
Type: A
DNSmemberdaughter.net
Type: A
DNSbeginready.net
Type: A
DNSknownready.net
Type: A
DNSbeginbrown.net
Type: A
DNSknownbrown.net
Type: A
DNSbeginpeople.net
Type: A
DNSbegindaughter.net
Type: A
DNSknowndaughter.net
Type: A
DNScrowdready.net
Type: A
DNSsummerbrown.net
Type: A
DNScrowdbrown.net
Type: A
HTTP GEThttp://partybottle.net/index.php
User-Agent:
HTTP GEThttp://fightbottle.net/index.php
User-Agent:
HTTP GEThttp://freshbusiness.net/index.php
User-Agent:
HTTP GEThttp://experiencebusiness.net/index.php
User-Agent:
HTTP GEThttp://followappear.net/index.php
User-Agent:
HTTP GEThttp://summerbusiness.net/index.php
User-Agent:
HTTP GEThttp://crowdbusiness.net/index.php
User-Agent:
HTTP GEThttp://waterbusiness.net/index.php
User-Agent:
HTTP GEThttp://womanbusiness.net/index.php
User-Agent:
HTTP GEThttp://partybusiness.net/index.php
User-Agent:
HTTP GEThttp://partyappear.net/index.php
User-Agent:
HTTP GEThttp://thoughtexplain.net/index.php
User-Agent:
HTTP GEThttp://smokeinside.net/index.php
User-Agent:
HTTP GEThttp://partybright.net/index.php
User-Agent:
HTTP GEThttp://knownpeople.net/index.php
User-Agent:
HTTP GEThttp://summerready.net/index.php
User-Agent:
HTTP GEThttp://summerpeople.net/index.php
User-Agent:
Flows TCP192.168.1.1:1031 ➝ 91.215.216.53:80
Flows TCP192.168.1.1:1032 ➝ 195.22.28.196:80
Flows TCP192.168.1.1:1033 ➝ 72.52.4.120:80
Flows TCP192.168.1.1:1034 ➝ 188.40.135.139:80
Flows TCP192.168.1.1:1035 ➝ 208.100.26.234:80
Flows TCP192.168.1.1:1036 ➝ 8.5.1.46:80
Flows TCP192.168.1.1:1037 ➝ 72.52.4.91:80
Flows TCP192.168.1.1:1038 ➝ 192.185.77.17:80
Flows TCP192.168.1.1:1039 ➝ 184.168.221.52:80
Flows TCP192.168.1.1:1040 ➝ 50.62.253.1:80
Flows TCP192.168.1.1:1041 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1042 ➝ 208.100.26.234:80
Flows TCP192.168.1.1:1043 ➝ 50.63.202.34:80
Flows TCP192.168.1.1:1044 ➝ 50.63.202.44:80
Flows TCP192.168.1.1:1045 ➝ 50.30.43.150:80
Flows TCP192.168.1.1:1046 ➝ 198.71.232.3:80
Flows TCP192.168.1.1:1047 ➝ 65.254.248.141:80

Raw Pcap

Strings