Search

name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).) This report is generated via an automated analysis system. TrojanDownloader:O97M/Obfuse.PF!MTB (Microsoft);

(64-bit).) This report is generated via an automated analysis system. TrojanDownloader:O97M/Emotet.OB!MTB (Microsoft); W97M/Downloader.wj, W97M/Downloader.ip, W97M/Downloader.wj (McAfee); Troj/DocDl-VSS

\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).) This report is generated via an automated analysis system. TrojanDownloader:O97M/Powdow.ARJ!MTB (Microsoft);

automated analysis system. Trojan:Win32/Skeeyah.A!MTB (Microsoft); Trojan-Downloader.Win32.Bandit.hiv (Kaspersky); Mal/GandCrab-G (Sophos)

(64-bit).) This report is generated via an automated analysis system. TrojanDownloader:O97M/Obfuse.NO!MTB (Microsoft); W97M/Downloader.ip (McAfee)

https://{BLOCKED}ndsafaris.com/wp-admin/861216/ https://www.{BLOCKED}ibangalore.com/bsnwmap/v87241/ TrojanDownloader:O97M/Obfuse.LC!MTB (Microsoft); RDN/Generic Downloader.x (McAfee); Troj/DocDl-VND (Sophos)

TrojanDownloader:O97M/MalSpam!MTB (Microsoft); RDN/Generic Downloader.x (McAfee); Trojan.MSOffice.Agent.be (Kaspersky); Troj/DocDl-WQR (Sophos)

Trojan:MSIL/NanoBot.DH!MTB (Microsoft); RDN/Generic.dx (McAfee); HEUR:Trojan.MSIL.NanoBot.gen (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt)

" Other Details This Trojan Spy connects to the following possibly malicious URL: http://{BLOCKED}ontrol.com This report is generated via an automated analysis system. Trojan:Win32/Qbot.PVD!MTB (Microsoft);

\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).) This report is generated via an automated analysis system. Trojan:Win32/Predator.BC!MTB [non_writable_container]

following possibly malicious URL: {BLOCKED}.{BLOCKED}.199.223:587 Trojan:Win32/Lokibot.ART!MTB (MICROSOFT)

}937gcuc7l7deffksulhg5h7mbp1/t8numkt66u6lijhvqhipqtea90hrqp78/1582683300000/05577264133141314656/*/1xBAoDc7yh4AkbzJ3q5lhJZjYFDexSwBk?e=download http://{BLOCKED}py.tech/etty/black/download/fre.php It deletes itself after execution. Trojan:Win32/Fareit.VB!MTB (Microsoft); Fareit-FRM!06AE79CA9FAA

Trojan:PowerShell/Emotet.RVK!MTB (MICROSOFT) Downloaded from the Internet, Dropped by other malware Connects to URLs/IPs, Modifies system registry

(32-bit) and XP.) Trojan:JS/Qakbot.ESM!MTB (MICROSOFT), Dropped by other malware, Downloaded from the Internet Connects to URLs/IPs, Downloads files

.RAWLD .iso .msi .bin Ransom:Win32/Babuk.MAK!MTB (MICROSOFT) Downloaded from the Internet, Dropped by other malware Encrypts files, Terminates processes

address} Trojan:Win32/CryptInject.PACC!MTB (MICROSOFT) Downloaded from the Internet, Dropped by other malware Collects system information, Connects to URLs/IPs, Displays windows

Exploit:O97M/CVE-2017-8570.AJ!MTB [non_writable_container] (Microsoft); Exploit-cve2017-8570.h (McAfee); HEUR:Trojan-Downloader.VBS.Agent.gen (Kaspersky)

analysis system. VirTool:MSIL/CryptInject.BB!MTB (Microsoft); RDN/Ransom (McAfee); HEUR:Trojan-Ransom.MSIL.Blocker.gen (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt)

connects to the following possibly malicious URL: http://{BLOCKED}p.net This report is generated via an automated analysis system. Trojan:Win32/Skeeyah.A!MTB (Microsoft); Trojan-FRIK!1C4CCBF19572 (McAfee);

encrypted files: .RYK It drops the following file(s) as ransom note: {Encrypted Directory}\RyukReadMe.html Ransom:Win64/Ryuk.PA!MTB (Microsoft) Dropped by other malware, Downloaded from the Internet