MAR-10365227.r2.v1 Malware Characterization //node() | //@* This document is marked TLP:WHITE--Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.cisa.gov/tlp. cisa 2022-09-20T13:52:22-04:00 BMachine 134 7.1.0 msmpeng.exe 351240 PE32 executable (GUI) Intel 80386, for MS Windows MD5 4109ac08bdc8591c7b46348eb1bca85d SHA1 6423d1c324522bfd2b65108b554847ac4ab02479 SHA256 df847abbfac55fb23715cde02ab52cbe59f14076f9e4bd15edbe28dcecb2a348 SHA512 0605362190a9cb04a7392c7eae3ef79964a76ea68dc03dfabe6ec8f445f1c355772f2ca8166cbee73188e57bff06b74fb2cfa59869cb4461fffe1c3589856554 SSDEEP 6144:BTMoU0+zvvLIpa8bo5GOc1G41vupWn2rwRGekPHZLZKA1UnmOlm:XUDvvsc80AOc1GYvAW2EGtH5ZKAKmOQ Microsoft Visual C++ ?.? 6.471736 5 2016-01-05 08:22:40-05:00 1024 MD5 3822119e846581669481aba79308c57c 2.580725 CyberArk Software Ltd. CyberArk Viewfinity 5.5.10.101 vf_host.exe Copyright © 1999-2016 CyberArk Software Ltd. All Rights Reserved. vf_host.exe CyberArk Viewfinity 5.5.10.101 .text 270848 6.543317 MD5 98ccfff2af4ccaa3335f63592a1fba02 .rdata 50688 5.132125 MD5 9dcc89a0d16e36145bb07924ca260dfe .data 5632 3.711689 MD5 14d493033fc147f67601753310725b2b .rsrc 16896 4.839559 MD5 615729d1383743a91b8baf309f1a8232 Used vftrace.dll 73728 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 7655ff65f74f08ee2c54f44e5ef8f098 SHA1 3c7beb8978feac9ba8f5bab0656242232471bf7d SHA256 52072a8f99dacd5c293fccd051eab95516d8b880cd2bc5a7e0f4a30d008e22a7 SHA512 efea9b8a7b6b7cfa31814af4ffe45fab68d159a6239271b632166b2f6b44af8a4e1cc559fa56537ec4142e0484031a9b79034d4e5a8cbbf1d5250b86370cdfcf SSDEEP 1536:d0X1BkgxVXJyBaUihWutqQQ4znsWgcdqydbPX:O7XMBOs41znqypP Borland Delphi 3.0 (???) 6.334911 7 2021-03-02 02:18:56-05:00 1024 MD5 a89421fb59d33658892123b94906aa72 2.836214 .text 42496 6.692212 MD5 624b09cd367db7ebfc510aab51f95791 .rdata 23552 4.949495 MD5 8885c137e1772d11b48e71da92aa3d3c .data 2048 2.051382 MD5 2304803a4ce5a785e19eb0b45efb7065 .gfids 512 1.386027 MD5 2139727f6ccf1b15d0f96e805001b2fc .rsrc 512 4.712298 MD5 a4fc8d9199bcb8669008e62d5dc7d675 .reloc 3584 6.466489 MD5 73a0737f1475d88793ad42fc04bef1ab Connected_To Used_By Created Created 104.168.236.46 Related_To Connected_From Related_To Related_To 443 TCP hxxps[:]//104.168.236.46/api/v2/ajax Domain Name: HOSTWINDSDNS.COM Registry Domain ID: 1655837964_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.namecheap.com Registrar URL: http://www.namecheap.com Updated Date: 2021-06-25T06:27:14Z Creation Date: 2011-05-12T23:01:53Z Registry Expiry Date: 2029-05-12T23:01:53Z Registrar: NameCheap, Inc. Registrar IANA ID: 1068 Registrar Abuse Contact Email: abuse@namecheap.com Registrar Abuse Contact Phone: +1.6613102107 Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Name Server: DNS1.HOSTWINDSDNS.COM Name Server: DNS2.HOSTWINDSDNS.COM Name Server: DNS3.HOSTWINDSDNS.COM Name Server: DNS4.HOSTWINDSDNS.COM DNSSEC: unsigned Domain name: hostwindsdns.com Registry Domain ID: 1655837964_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.namecheap.com Registrar URL: http://www.namecheap.com Updated Date: 2020-04-27T12:40:10.00Z Creation Date: 2011-05-12T23:01:53.00Z Registrar Registration Expiration Date: 2029-05-12T23:01:53.00Z Registrar: NAMECHEAP INC Registrar IANA ID: 1068 Registrar Abuse Contact Email: abuse@namecheap.com Registrar Abuse Contact Phone: +1.9854014545 Reseller: NAMECHEAP INC Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Registry Registrant ID: Redacted for Privacy Purposes Registrant Name: Redacted for Privacy Purposes Registrant Organization: Redacted for Privacy Purposes Registrant Street: Redacted for Privacy Purposes Registrant City: Redacted for Privacy Purposes Registrant State/Province: WA Registrant Postal Code: Redacted for Privacy Purposes Registrant Country: US Registrant Phone: Redacted for Privacy Purposes Registrant Phone Ext: Redacted for Privacy Purposes Registrant Fax: Redacted for Privacy Purposes Registrant Fax Ext: Redacted for Privacy Purposes Registrant Email: Select Contact Domain Holder link at https://www.namecheap.com/domains/whois/result?domain=hostwindsdns.com Registry Admin ID: Redacted for Privacy Purposes Admin Name: Redacted for Privacy Purposes Admin Organization: Redacted for Privacy Purposes Admin Street: Redacted for Privacy Purposes Admin City: Redacted for Privacy Purposes Admin State/Province: Redacted for Privacy Purposes Admin Postal Code: Redacted for Privacy Purposes Admin Country: Redacted for Privacy Purposes Admin Phone: Redacted for Privacy Purposes Admin Phone Ext: Redacted for Privacy Purposes Admin Fax: Redacted for Privacy Purposes Admin Fax Ext: Redacted for Privacy Purposes Admin Email: Select Contact Domain Holder link at https://www.namecheap.com/domains/whois/result?domain=hostwindsdns.com Registry Tech ID: Redacted for Privacy Purposes Tech Name: Redacted for Privacy Purposes Tech Organization: Redacted for Privacy Purposes Tech Street: Redacted for Privacy Purposes Tech City: Redacted for Privacy Purposes Tech State/Province: Redacted for Privacy Purposes Tech Postal Code: Redacted for Privacy Purposes Tech Country: Redacted for Privacy Purposes Tech Phone: Redacted for Privacy Purposes Tech Phone Ext: Redacted for Privacy Purposes Tech Fax: Redacted for Privacy Purposes Tech Fax Ext: Redacted for Privacy Purposes Tech Email: Select Contact Domain Holder link at https://www.namecheap.com/domains/whois/result?domain=hostwindsdns.com Name Server: dns1.hostwindsdns.com Name Server: dns2.hostwindsdns.com Name Server: dns3.hostwindsdns.com Name Server: dns4.hostwindsdns.com DNSSEC: unsigned config.ini 49 ASCII text, with CRLF line terminators MD5 9d8d7d7bb357ee37a6ae71c5140f28b9 SHA1 40fc8b1a691339b9fa1526970ff2a2e1d3f899d7 SHA256 f1a2791eebaea183f399110c9e8ae11c67f5bebf93a5573d1ac3c56fc71b2230 SHA512 1d30fb579e0dba09b24669a5a981652f1f6404d2f536e8e640c48585b3035d0826fed15279568400418c19849e17489baccd18e35b53f8cdbc196a0dd5abd496 SSDEEP 3:pSMk0eR2Hxm+yn:pSMFeR2Vy 4.546046 Created_By thumb.dat 58274 data MD5 84f09d192ec90542ede22c370836ffa6 SHA1 7fb23c6b4db90b55694bdd1cc5c1b4c706a4e181 SHA256 f2ba8b8aabf73020febd3a925276d52ce88f295537fe57723df714c13f5a8780 SHA512 56474f45eed25ab86ac9d17b6afb69e0dee07fe507fc5ac4e22ebae0d124700c533dc2adaaaf4be096a5dab27f7f88c21b290cca600576dbf8f10482f2f62d8b SSDEEP 1536:xy98XehX2k0xfXGxGKt5mzvOOIE3CYzahbdoZJI7Vq:xRX0X90KNtevUXYzahbdfq 7.301514 Created_By MD5 and SHA1 of Malicious File Malware Artifacts MD5 4109ac08bdc8591c7b46348eb1bca85d SHA1 6423d1c324522bfd2b65108b554847ac4ab02479 SHA256 df847abbfac55fb23715cde02ab52cbe59f14076f9e4bd15edbe28dcecb2a348 NCCIC 2022-09-21T13:52:27+00:00 MD5 and SHA1 of Malicious File Malware Artifacts MD5 7655ff65f74f08ee2c54f44e5ef8f098 SHA1 3c7beb8978feac9ba8f5bab0656242232471bf7d SHA256 52072a8f99dacd5c293fccd051eab95516d8b880cd2bc5a7e0f4a30d008e22a7 NCCIC 2022-09-21T13:52:27+00:00 Malicious IP IP Watchlist 104.168.236.46 NCCIC 2022-09-21T13:52:27+00:00 MD5 and SHA1 of Malicious File Malware Artifacts MD5 84f09d192ec90542ede22c370836ffa6 SHA1 7fb23c6b4db90b55694bdd1cc5c1b4c706a4e181 SHA256 f2ba8b8aabf73020febd3a925276d52ce88f295537fe57723df714c13f5a8780 NCCIC 2022-09-21T13:52:28+00:00 loader MAEC Characterization of 7655ff65f74f08ee2c54f44e5ef8f098 Bitdefender Gen:Variant.Bulz.429221 K7 Riskware ( 0040eff71 ) IKARUS Trojan.Win32.LuckyMouse Cyren W32/Agent.GCPS-3922 Trend Micro HouseCall Trojan.780F7AE8 Zillya! Trojan.LuckyMouse.Win32.24 Comodo Malware AhnLab Trojan/Win.HYPERBRO Sophos Troj/Agent-BGVD Trend Micro Trojan.780F7AE8 Avira TR/Injector.nmrbf VirusBlokAda TScope.Malware-Cryptor.SB ESET a variant of Win32/LuckyMouse.BR trojan NANOAV Trojan.Win32.LuckyMouse.iwacwz Adaware Gen:Variant.Bulz.429221 trojan command-and-control backdoor keylogger 10365227.r2.v1 Malicious Code Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected