Search
Keyword: chopper.ac!mtb
Trojan connects to the following possibly malicious URL: http://{BLOCKED}db.com/ip_query.php http://irc.{BLOCKED}x.nl This report is generated via an automated analysis system. Trojan:Win32/Skeeyah.A!MTB
}lcertvalidation.com/TrustAsiaTLSRSACA.crt http://{BLOCKED}gcheng.net/wp-content/uploads/9/77823.png This report is generated via an automated analysis system. Exploit:O97M/CVE-2017-11882.ANK!MTB (Microsoft); HEUR:Exploit.MSOffice.Generic
Exploit:O97M/CVE-2017-11882.RJ!MTB (Microsoft); Exploit-GAN!E48E2295A6F9 (McAfee); HEUR:Exploit.MSOffice.Generic (Kaspersky)
automated analysis system. Trojan:Win32/IStartSurf.MT!MTB (Microsoft); IStartSurf. (McAfee); HEUR:Trojan.Win32.Biodata.vho (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt)
automated analysis system. Trojan:Win32/IStartSurf.MV!MTB (Microsoft); IStartSurf. (McAfee); HEUR:Trojan.Win32.Biodata.vho (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt)
automated analysis system. Trojan:Win32/IStartSurf.MV!MTB (Microsoft); IStartSurf. (McAfee); Trojan.Win32.Biodata.fqxc (Kaspersky); Win32.Malware!Drop (Sunbelt)
file path and name}" This report is generated via an automated analysis system. PWS:Win32/Fareit.D!MTB (Microsoft); Fareit-FPN!E26D1C93EE22 (McAfee); Trojan.Win32.VBKryjetor.cani (Kaspersky);
System Modifications This Backdoor adds the following registry entries: HKEY_CURRENT_USER (Default) = "" This report is generated via an automated analysis system. Trojan:MSIL/Androm.AK!MTB (Microsoft);
\Software\VB and VBA Program Settings\ Firepr\Creamcu6 SNIFFER = "dancevarme" This report is generated via an automated analysis system. Trojan:Win32/VbInject!MTB (Microsoft); RDN/Generic.grp (McAfee);
(Default) = "" This report is generated via an automated analysis system. TrojanDownloader:O97M/Obfuse.NF!MTB (Microsoft)
an automated analysis system. TrojanDownloader:O97M/Emotet.TI!MTB (Microsoft); W97M/Downloader.zu (McAfee)
report is generated via an automated analysis system. Trojan:Win32/SmkLdr!MTB (Microsoft); RDN/Generic.grp (McAfee); Trojan.Win32.Generic!BT (Sunbelt)
" Other Details This Trojan Spy connects to the following possibly malicious URL: http://{BLOCKED}fdgdf.ug This report is generated via an automated analysis system. Trojan:Win32/Netwire.AA!MTB (Microsoft);
automated analysis system. Trojan:Win32/IStartSurf.MV!MTB (Microsoft); IStartSurf. (McAfee); HEUR:Trojan.Win32.Biodata.vho (Kaspersky); Win32.Malware!Drop (Sunbelt)
environment in order to proceed with its intended routine. HackTool:Linux/Prtscan.A!MTB (MICROSOFT)
order to proceed with its intended routine. Trojan:MSIL/AgentTesla.PK!MTB (MICROSOFT)
order to proceed with its intended routine. Trojan:Win64/CobaltStrike.ZEL!MTB (MICROSOFT)
environment in order to proceed with its intended routine. Ransom:Win32/StopCrypt.MKSS!MTB (MICROSOFT)
environment in order to proceed with its intended routine. Ransom:Win64/Magniber.ADA!MTB (MICROSOFT)
}ielts.com/PvYsQMezfHK/93i.png https://{BLOCKED}ryantweekes.com/R4uDKgmAJJY/9i.png https://{BLOCKED}youwant.com/LACxAeU53/92i.png TrojanDownloader:O97M/Encdoc.AMD!MTB (Microsoft), DOC/TrojanDownloader.Agent.DUQ (Kaspesky)