File: c7f50d60f824ddda65c11480bd19091df2667458fa16a47ab3ac652bc7c409ee
Metadata
| image2017-11-22-1666714.vbs | |
| ASCII text, with CRLF line terminators | 4052 bytes |
| 2017-11-23 09:59:04 | |
| 04119bf6c79dd950d243290bfa05640e | |
| d650a301621e53e818033953a8da47bab41423d4 | |
| c7f50d60f824ddda65c11480bd19091df2667458fa16a47ab3ac652bc7c409ee | |
| b0d0cc7068c49ed24cf47009479029b808a19d93755f87277c68de607a19a071d5e1d8eaf82191f24ba9eba5eb3dc4ee8a7f1e7c49e103a7a92bb2ee9f9bc1b4 | |
| N/A | |
| N/A | |
| N/A | |
APTNotes
Cyber threat intelligence reports associated with c7f50d60f824ddda65c11480bd19091df2667458fa16a47ab3ac652bc7c409ee.
Cyber threat intelligence reports associated with c7f50d60f824ddda65c11480bd19091df2667458fa16a47ab3ac652bc7c409ee.
Domains
Domains the malware sample communicates with.
Domains the malware sample communicates with.
| Domain | IP |
|---|---|
| atlantarecyclingcenters.com | N/A |
| iplogger.co | N/A |
| xploramail.com | N/A |
Hosts
Hosts the malware sample communicates with.
Hosts the malware sample communicates with.
HTTP Requests
HTTP requests the malware sample makes.
HTTP requests the malware sample makes.
| Host | URL | User-Agent |
|---|---|---|
| 98.124.251.75 (atlantarecyclingcenters.com) | /JHgd476? | Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) |
| N/A | ||
| N/A | ||
| N/A | ||
| 185.57.172.213 (xploramail.com) | /JHgd476? | Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) |
| N/A | ||
| N/A | ||
| N/A | ||
| 88.99.66.31 (iplogger.co) | /18RtV6.jpg | |
| N/A | ||
| N/A | ||
| N/A |
AV Detections
AV detection names associated with the malware sample.
AV detection names associated with the malware sample.
Mutants
Mutants created by the malware sample.
Mutants created by the malware sample.
| "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" |
| "\Sessions\1\BaseNamedObjects\Local\c:!users!de52vu1!appdata!roaming!microsoft!windows!cookies!" |
| "\Sessions\1\BaseNamedObjects\Local\c:!users!de52vu1!appdata!local!microsoft!windows!history!history.ie5!" |
| "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" |
| "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" |
| "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" |
| "\Sessions\1\BaseNamedObjects\Local\!IETld!Mutex" |
| "\Sessions\1\BaseNamedObjects\Local\c:!users!de52vu1!appdata!roaming!microsoft!windows!ietldcache!" |
| "\Sessions\1\BaseNamedObjects\RasPbFile" |
| "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" |
| "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" |
| "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" |
| "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" |
| "\Sessions\1\BaseNamedObjects\Local\c:!users!de52vu1!appdata!local!microsoft!windows!temporary internet files!content.ie5!" |
| "Local\ZoneAttributeCacheCounterMutex" |
| "Local\_!MSFTHISTORY!_" |
| "Local\WininetConnectionMutex" |
| "Local\ZonesCounterMutex" |
| "RasPbFile" |
| "Local\c:!users!de52vu1!appdata!local!microsoft!windows!history!history.ie5!" |
Registry keys
Registry keys created by the malware sample.
Registry keys created by the malware sample.
Comments
User comments about c7f50d60f824ddda65c11480bd19091df2667458fa16a47ab3ac652bc7c409ee.
User comments about c7f50d60f824ddda65c11480bd19091df2667458fa16a47ab3ac652bc7c409ee.
