SonicALERT
Search

Sonicwall Signatures

 

Go to All Categories list.


  MalAgent.J_50896
MalAgent.J_50896 is a Trojan. A Trojan is a program that pretends to have a valid use, but in fact modifies the user's computer in malicious ways. Trojans do not replicate or spread to other computers.

Mutexes created
  • Raum-with-Me


Directory level activity
  • create - dir - C:\Intel
  • create - dir - C:\Intel


File level activity
  • write - file - C:\Intel\tmp-0.bin
  • write - file - C:\Intel\WMIC.exe
  • delete - file - C:\Intel\backup.exe
  • delete - file - C:\Intel\backup.exe


Registry level activity
    • Nothing to report


    Library level activity
    • load - library - kernel32.dll
    • load - library - kernel32.dll


    Process API calls used
    • NtCreateSection
    • ZwMapViewOfSection
    • NtFreeVirtualMemory
    • CreateProcessInternalW
    • ExitProcess


    Registry API calls used
      • Nothing to report


      System API calls used
      • LdrGetDllHandle
      • LdrGetProcedureAddress
      • LdrGetProcedureAddress


      Filesystem API calls used
      • CreateDirectoryW
      • NtCreateFile
      • NtWriteFile
      • NtOpenFile
      • NtSetInformationFile
      • NtQueryInformationFile
      • NtReadFile
      • NtWriteFile

      Network

      UDP source >> destination
      • 192.168.30.3 >> 192.168.30.255


      TCP source >> destination
      • 192.168.30.3 >> 92.63.100.128



      Domains:
      • NA

      DNS Request:
      • NA

      HTTP Request:
      • GET URI - http://92.63.100.128/tools/RegWriter.exe.raum_encrypted

      DLL related data
      Number of DLL's imported = 4
      • KERNEL32.dll
      • USER32.dll
      • OLEAUT32.dll
      • WS2_32.dll


      Relevant Information