File: 37aafabfcb98febe319880d6dccaf346
Metadata
| http://email.nomoresends.com/c/1ONzMRHQcQF4ipUcpRVoBEk93 | |
| N/A | N/A |
| 2018-06-27 15:56:12 | |
| 37aafabfcb98febe319880d6dccaf346 | |
| e25ae53b9a3d24677d1bc84ea2b2fa09630e669b | |
| 5ad8c694b336d25cfe448e0ea3988912575ad255969229bdbe04c29bbf37cf59 | |
| N/A | |
| N/A | |
| N/A | |
| N/A | |
| Source: |
APTNotes
Cyber threat intelligence reports associated with 37aafabfcb98febe319880d6dccaf346.
Cyber threat intelligence reports associated with 37aafabfcb98febe319880d6dccaf346.
Domains
Domains the malware sample communicates with.
Domains the malware sample communicates with.
| Domain | IP |
|---|---|
| sedoparking.com | N/A |
| pagead2.googlesyndication.com | N/A |
| email.nomoresends.com | N/A |
Hosts
Hosts the malware sample communicates with.
Hosts the malware sample communicates with.
HTTP Requests
HTTP requests the malware sample makes.
HTTP requests the malware sample makes.
| Host | URL | User-Agent |
|---|---|---|
| 208.91.197.91 (email.nomoresends.com) | /c/1ONzMRHQcQF4ipUcpRVoBEk93 | Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) |
| N/A | ||
| N/A | ||
| N/A | ||
| 208.91.197.91 (email.nomoresends.com) | /?fp=3sj2X922vZXhBEJ8Skdfoz0sQkOq6W%2BzEB1u0GhuVx%2FXswReOBm4XkJh02%2F%2FDZL5zHjQrGdFck980Z5J7mwjcg%3D%3D&prvtof=OmLGIMDwoUiPqpY... | 53 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 4D [S..User-Agent |
| N/A | ||
| N/A | ||
| N/A | ||
| 72.52.4.90 (sedoparking.com) | /frmpark/email.nomoresends.com/Skenzor12/park.js | Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) |
| N/A | ||
| N/A | ||
| N/A | ||
| 208.91.197.91 (email.nomoresends.com) | /favicon.ico | Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) |
| N/A | ||
| N/A | ||
| N/A |
AV Detections
AV detection names associated with the malware sample.
AV detection names associated with the malware sample.
Mutants
Mutants created by the malware sample.
Mutants created by the malware sample.
| "\Sessions\1\BaseNamedObjects\ConnHashTable<5344>_HashTable_Mutex" |
| "Local\!BrowserEmulation!SharedMemory!Mutex" |
| "Local\WininetConnectionMutex" |
| "Local\Feeds Store Mutex S-1-5-21-4162757579-3804539371-4239455898-1000" |
| "ConnHashTable<5344>_HashTable_Mutex" |
| "Local\ZonesCacheCounterMutex" |
| "Local\ZoneAttributeCacheCounterMutex" |
| "Local\RSS Eventing Connection Database Mutex 000014e0" |
| "Local\Feed Eventing Shared Memory Mutex S-1-5-21-4162757579-3804539371-4239455898-1000" |
| "IESQMMUTEX_0_208" |
| "RasPbFile" |
| "Local\WininetStartupMutex" |
| "Local\WininetProxyRegistryMutex" |
| "Local\ZonesLockedCacheCounterMutex" |
| "Local\Feed Arbitration Shared Memory Mutex [ User : S-1-5-21-4162757579-3804539371-4239455898-1000 ]" |
| "Local\ZonesCounterMutex" |
| "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" |
| "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" |
| "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" |
| "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" |
Registry keys
Registry keys created by the malware sample.
Registry keys created by the malware sample.
Comments
User comments about 37aafabfcb98febe319880d6dccaf346.
User comments about 37aafabfcb98febe319880d6dccaf346.
