mothered Wrote:

TheMinister Wrote:thank you mothered for reply i am sorry i had internet problems i couldn't reply

All good, no problem whatsoever.

TheMinister Wrote:is there a kind of sandbox tool  that run the program and gives you a list of files and registry files that are Opened/excuted from the .exe like the behavior of virustotal example inside a sandbox ?

A tool named Buster Sandbox Analyzer does the job well.

You can read about It here.

(09-23-2020, 09:21 PM)TheMinister Wrote:

(09-23-2020, 04:59 PM)mothered Wrote:

(09-23-2020, 01:00 PM)TheMinister Wrote: i appreciate the info thank you very much.

You're most welcome.

When you have time, I'd be Interested to read how the tool performs.

ill notify you when i add the BSA and use it, i am currently focused on unity engine and same time learning c++

(09-23-2020, 12:30 PM)mothered Wrote:

(09-23-2020, 11:51 AM)TheMinister Wrote: thank you mothered for reply i am sorry i had internet problems i couldn't reply

All good, no problem whatsoever.

(09-23-2020, 11:51 AM)TheMinister Wrote: is there a kind of sandbox tool  that run the program and gives you a list of files and registry files that are Opened/excuted from the .exe like the behavior of virustotal example inside a sandbox ?

A tool named ]Buster Sandbox Analyzer does the job well.

You can read about It here.

(10-03-2020, 09:31 PM)fritz Wrote:

(09-23-2020, 12:30 PM)mothered Wrote:

(09-23-2020, 11:51 AM)TheMinister Wrote: thank you mothered for reply i am sorry i had internet problems i couldn't reply

All good, no problem whatsoever.

(09-23-2020, 11:51 AM)TheMinister Wrote: is there a kind of sandbox tool  that run the program and gives you a list of files and registry files that are Opened/excuted from the .exe like the behavior of virustotal example inside a sandbox ?

A tool named ]Buster Sandbox Analyzer does the job well.

You can read about It here.

Well the installer obviously is infected :

Code:

Detailed report of suspicious malware actions: Checked for debuggers Code injection in process: C:\Users\root\AppData\Local\Temp\Gqyxwc.exe Code injection in process: C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe Code injection in process: C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe Created a mutex named: IYDX2N3B35ZX7PK4HKLM Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\ANDROID TESTER.EXE Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\AUDIO\C.WAV Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\ACCOUNTMANAGER\ACCOUNT.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\APPPROPERTIES\ACTIVITIES.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\BAR\BLUETOOTH.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\BATTERY\B0FALSE.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\CALLSMANAGER\INCOMING.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\CAMERA\FLASH.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\CHAT\C0.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\CTX_MENU\ACC.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\DEVICO\ICON.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\DPM\F.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\FILEBOX\CAMERA.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\FILEMANAGER\-1.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\FLAGS\-1.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\LOCATION\ERRORIMAGE.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\LOGO\LOGO.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\MICROPHONE\1SOUNDTEMPLATE\TEMPLATE.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\NETWORKSTATUS\MD2G.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\NFD\NF.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\NOTE\NDOWN.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\PAYLOAD\B0.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\PHONE\0.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\PINF\BATTERY.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\RE\C.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\SCREEN\KEY&SCREENOFF.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\SCROLLBAR\BOTTOM-RIGHT.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\SKULLS\ATTACKS.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\SMS\ALL.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\TERMINAL\C.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\TOOLSTRIP\0\CMD.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\WINDOW\W0.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\WINDOW\WIN\0.ICO Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\GEOIP\GEOIP.DAT Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\GSM\GSM.DLL Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\PAYLOAD\APKTOOL.ASCII Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\PLATFORM-TOOLS\PACK.INF Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\PLAYERJAVA\PLAYERJAVA.JAR Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\T\SS.EXE Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\XML\SETTINGS\ANDROIDTESTER.XML Created an event named: Global\CPFATE_1560_v4.0.30319 Created an event named: Global\CPFATE_3640_v4.0.30319 Created an event named: Global\CPFATE_4216_v4.0.30319 Created an event named: Global\CPFATE_5944_v4.0.30319 Created an event named: Global\CPFATE_6708_v4.0.30319 Created process: C:\Users\root\AppData\Local\Temp\Gqyxwc.exe, "C:\Users\root\AppData\Local\Temp\Gqyxwc.exe" , C:\Users\root\Downloads\AndroidTester v6.4.6 Created process: C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe, "C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe" , C:\Users\root\Downloads\AndroidTester v6.4.6 Created process: C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe, "C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe" , C:\Users\root\Downloads\AndroidTester v6.4.6 Defined file type created: C:\Users\root\AppData\Local\Temp\Gqyxwc.exe Defined file type created: C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe Defined file type created: C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe Defined registry AutoStart location created or modified: user\current\software\Microsoft\Windows\CurrentVersion\Run\{4WGW3Q1D-826409-4CNC3X-4CNC3XGK3F} = "C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe" .. Detected keylogger functionality Detected privilege modification Detected process privilege elevation Enumerated running processes Error reporting dialog change: machine\software\microsoft\windows\windows error reporting\dontshowui = 00000001 Got input locale identifiers Got system default language ID Queried DNS: dns.msftncsi.com Queried DNS: micromedia.sytes.net Queried DNS: Mju-49682.portmap.io Traces of Max++

And when I run the executable it looks almost clean (I'm not used to those reports) :

Code:

Detailed report of suspicious malware actions: Checked for debuggers Checked for Microsoft Management Console software presence Created a mutex named: .NET CLR Data_Perf_Library_Lock_PID_240 Created a mutex named: .NET CLR Networking 4.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: .NET CLR Networking_Perf_Library_Lock_PID_240 Created a mutex named: .NET Data Provider for Oracle_Perf_Library_Lock_PID_240 Created a mutex named: .NET Data Provider for SqlServer_Perf_Library_Lock_PID_240 Created a mutex named: .NET Memory Cache 4.0_Perf_Library_Lock_PID_240 Created a mutex named: .NETFramework_Perf_Library_Lock_PID_240 Created a mutex named: BITS_Perf_Library_Lock_PID_240 Created a mutex named: ESENT_Perf_Library_Lock_PID_240 Created a mutex named: Global\CLR_PerfMon_WrapMutex Created a mutex named: Lsa_Perf_Library_Lock_PID_240 Created a mutex named: LSM_Perf_Library_Lock_PID_240 Created a mutex named: MSDTC Bridge 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: MSDTC Bridge 4.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: MSDTC_Perf_Library_Lock_PID_240 Created a mutex named: MSSCNTRS_Perf_Library_Lock_PID_240 Created a mutex named: PerfDisk_Perf_Library_Lock_PID_240 Created a mutex named: PerfNet_Perf_Library_Lock_PID_240 Created a mutex named: PerfOS_Perf_Library_Lock_PID_240 Created a mutex named: PerfProc_Perf_Library_Lock_PID_240 Created a mutex named: rdyboost_Perf_Library_Lock_PID_240 Created a mutex named: RemoteAccess_Perf_Library_Lock_PID_240 Created a mutex named: ServiceModelEndpoint 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: ServiceModelOperation 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: ServiceModelService 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: SMSvcHost 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: SMSvcHost 4.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: Spooler_Perf_Library_Lock_PID_240 Created a mutex named: TapiSrv_Perf_Library_Lock_PID_240 Created a mutex named: Tcpip_Perf_Library_Lock_PID_240 Created a mutex named: TermService_Perf_Library_Lock_PID_240 Created a mutex named: UGatherer_Perf_Library_Lock_PID_240 Created a mutex named: UGTHRSVC_Perf_Library_Lock_PID_240 Created a mutex named: usbhub_Perf_Library_Lock_PID_240 Created a mutex named: Windows Workflow Foundation 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: Windows Workflow Foundation 4.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: WmiApRpl_Perf_Library_Lock_PID_240 Created a mutex named: WSearchIdxPi_Perf_Library_Lock_PID_240 Created an event named: Global\CLR_PerfMon_DoneEnumEvent Created an event named: Global\CLR_PerfMon_StartEnumEvent Created an event named: Global\CPFATE_576_v4.0.30319 Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\.NET CLR Data\Linkage\Export = .NET CLR Data Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\.NET CLR Networking\Linkage\Export = .NET CLR Networking Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\.NET Data Provider for Oracle\Linkage\Export = .NET Data Provider for Oracle Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\.NET Data Provider for SqlServer\Linkage\Export = .NET Data Provider for SqlServer Detected privilege modification Detected process privilege elevation Enumerated running processes Error reporting dialog change: machine\software\microsoft\windows\windows error reporting\dontshowui = 00000001 Got computer name Locked screen Traces of Max++

I didn't go further yet, but despite that it seems to work as expected.

EDIT : Replaced Report.txt with Analysis.txt, much more concise

(10-04-2020, 02:05 AM)mothered Wrote:

(10-03-2020, 09:31 PM)fritz Wrote:

(09-23-2020, 12:30 PM)mothered Wrote: All good, no problem whatsoever.

A tool named ]Buster Sandbox Analyzer does the job well.

You can read about It here.

Well the installer obviously is infected :

Code:

Detailed report of suspicious malware actions: Checked for debuggers Code injection in process: C:\Users\root\AppData\Local\Temp\Gqyxwc.exe Code injection in process: C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe Code injection in process: C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe Created a mutex named: IYDX2N3B35ZX7PK4HKLM Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\ANDROID TESTER.EXE Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\AUDIO\C.WAV Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\ACCOUNTMANAGER\ACCOUNT.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\APPPROPERTIES\ACTIVITIES.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\BAR\BLUETOOTH.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\BATTERY\B0FALSE.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\CALLSMANAGER\INCOMING.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\CAMERA\FLASH.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\CHAT\C0.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\CTX_MENU\ACC.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\DEVICO\ICON.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\DPM\F.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\FILEBOX\CAMERA.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\FILEMANAGER\-1.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\FLAGS\-1.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\LOCATION\ERRORIMAGE.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\LOGO\LOGO.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\MICROPHONE\1SOUNDTEMPLATE\TEMPLATE.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\NETWORKSTATUS\MD2G.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\NFD\NF.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\NOTE\NDOWN.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\PAYLOAD\B0.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\PHONE\0.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\PINF\BATTERY.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\RE\C.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\SCREEN\KEY&SCREENOFF.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\SCROLLBAR\BOTTOM-RIGHT.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\SKULLS\ATTACKS.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\SMS\ALL.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\TERMINAL\C.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\TOOLSTRIP\0\CMD.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\WINDOW\W0.PNG Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\ICONS\WINDOW\WIN\0.ICO Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\GEOIP\GEOIP.DAT Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\GSM\GSM.DLL Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\PAYLOAD\APKTOOL.ASCII Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\PLATFORM-TOOLS\PACK.INF Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\PLAYERJAVA\PLAYERJAVA.JAR Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\T\SS.EXE Created Alternate Data Stream: \\?\C:\BSA\PUBLIC\ANDROIDTESTER V6.4.6\RESOURCES\IMPORTS\XML\SETTINGS\ANDROIDTESTER.XML Created an event named: Global\CPFATE_1560_v4.0.30319 Created an event named: Global\CPFATE_3640_v4.0.30319 Created an event named: Global\CPFATE_4216_v4.0.30319 Created an event named: Global\CPFATE_5944_v4.0.30319 Created an event named: Global\CPFATE_6708_v4.0.30319 Created process: C:\Users\root\AppData\Local\Temp\Gqyxwc.exe, "C:\Users\root\AppData\Local\Temp\Gqyxwc.exe" , C:\Users\root\Downloads\AndroidTester v6.4.6 Created process: C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe, "C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe" , C:\Users\root\Downloads\AndroidTester v6.4.6 Created process: C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe, "C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe" , C:\Users\root\Downloads\AndroidTester v6.4.6 Defined file type created: C:\Users\root\AppData\Local\Temp\Gqyxwc.exe Defined file type created: C:\Users\root\AppData\Local\Temp\Rwfvyeksnx.exe Defined file type created: C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe Defined registry AutoStart location created or modified: user\current\software\Microsoft\Windows\CurrentVersion\Run\{4WGW3Q1D-826409-4CNC3X-4CNC3XGK3F} = "C:\Users\root\AppData\Roaming\SecurityHealthSystray.exe" .. Detected keylogger functionality Detected privilege modification Detected process privilege elevation Enumerated running processes Error reporting dialog change: machine\software\microsoft\windows\windows error reporting\dontshowui = 00000001 Got input locale identifiers Got system default language ID Queried DNS: dns.msftncsi.com Queried DNS: micromedia.sytes.net Queried DNS: Mju-49682.portmap.io Traces of Max++

And when I run the executable it looks almost clean (I'm not used to those reports) :

Code:

Detailed report of suspicious malware actions: Checked for debuggers Checked for Microsoft Management Console software presence Created a mutex named: .NET CLR Data_Perf_Library_Lock_PID_240 Created a mutex named: .NET CLR Networking 4.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: .NET CLR Networking_Perf_Library_Lock_PID_240 Created a mutex named: .NET Data Provider for Oracle_Perf_Library_Lock_PID_240 Created a mutex named: .NET Data Provider for SqlServer_Perf_Library_Lock_PID_240 Created a mutex named: .NET Memory Cache 4.0_Perf_Library_Lock_PID_240 Created a mutex named: .NETFramework_Perf_Library_Lock_PID_240 Created a mutex named: BITS_Perf_Library_Lock_PID_240 Created a mutex named: ESENT_Perf_Library_Lock_PID_240 Created a mutex named: Global\CLR_PerfMon_WrapMutex Created a mutex named: Lsa_Perf_Library_Lock_PID_240 Created a mutex named: LSM_Perf_Library_Lock_PID_240 Created a mutex named: MSDTC Bridge 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: MSDTC Bridge 4.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: MSDTC_Perf_Library_Lock_PID_240 Created a mutex named: MSSCNTRS_Perf_Library_Lock_PID_240 Created a mutex named: PerfDisk_Perf_Library_Lock_PID_240 Created a mutex named: PerfNet_Perf_Library_Lock_PID_240 Created a mutex named: PerfOS_Perf_Library_Lock_PID_240 Created a mutex named: PerfProc_Perf_Library_Lock_PID_240 Created a mutex named: rdyboost_Perf_Library_Lock_PID_240 Created a mutex named: RemoteAccess_Perf_Library_Lock_PID_240 Created a mutex named: ServiceModelEndpoint 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: ServiceModelOperation 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: ServiceModelService 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: SMSvcHost 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: SMSvcHost 4.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: Spooler_Perf_Library_Lock_PID_240 Created a mutex named: TapiSrv_Perf_Library_Lock_PID_240 Created a mutex named: Tcpip_Perf_Library_Lock_PID_240 Created a mutex named: TermService_Perf_Library_Lock_PID_240 Created a mutex named: UGatherer_Perf_Library_Lock_PID_240 Created a mutex named: UGTHRSVC_Perf_Library_Lock_PID_240 Created a mutex named: usbhub_Perf_Library_Lock_PID_240 Created a mutex named: Windows Workflow Foundation 3.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: Windows Workflow Foundation 4.0.0.0_Perf_Library_Lock_PID_240 Created a mutex named: WmiApRpl_Perf_Library_Lock_PID_240 Created a mutex named: WSearchIdxPi_Perf_Library_Lock_PID_240 Created an event named: Global\CLR_PerfMon_DoneEnumEvent Created an event named: Global\CLR_PerfMon_StartEnumEvent Created an event named: Global\CPFATE_576_v4.0.30319 Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\.NET CLR Data\Linkage\Export = .NET CLR Data Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\.NET CLR Networking\Linkage\Export = .NET CLR Networking Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\.NET Data Provider for Oracle\Linkage\Export = .NET Data Provider for Oracle Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\.NET Data Provider for SqlServer\Linkage\Export = .NET Data Provider for SqlServer Detected privilege modification Detected process privilege elevation Enumerated running processes Error reporting dialog change: machine\software\microsoft\windows\windows error reporting\dontshowui = 00000001 Got computer name Locked screen Traces of Max++

I didn't go further yet, but despite that it seems to work as expected.

EDIT : Replaced Report.txt with Analysis.txt, much more concise

In your view, do you believe the file contains any form of malicious Intent?

(10-04-2020, 02:20 AM)fritz Wrote: The program itself looks quite safe though, but that could depend on functionalities. I'm pretty sure the first time I analysed it there was also a query to Mju-49682.portmap.io

(10-04-2020, 02:20 AM)fritz Wrote: Oh and thank you mothered for suggesting BSA, really like this tool !

(10-04-2020, 02:27 AM)mothered Wrote:

(10-04-2020, 02:20 AM)fritz Wrote: The program itself looks quite safe though, but that could depend on functionalities. I'm pretty sure the first time I analysed it there was also a query to Mju-49682.portmap.io

It seems Inconclusive at this stage.

Thanks for your analysis.

(10-04-2020, 02:32 AM)fritz Wrote: Yes of course I wouldn't recommend at all to use it, for sure not outside of a VM, imo it's more likely there are some other surprises.

(10-04-2020, 02:27 AM)mothered Wrote:

(10-04-2020, 02:20 AM)fritz Wrote: The program itself looks quite safe though, but that could depend on functionalities. I'm pretty sure the first time I analysed it there was also a query to Mju-49682.portmap.io

It seems Inconclusive at this stage.

Thanks for your analysis.

(10-04-2020, 02:20 AM)fritz Wrote: Oh and thank you mothered for suggesting BSA, really like this tool !

You're most welcome.

(10-04-2020, 12:26 PM)miso Wrote: the application is a self extractor, it contains the application however its behind like 3 exes, the installer isn't corrupted but is just a obfuscated .NET application.

the report @fritz gave shows 2 lists, one with the extracted files while the other (i think) is about the registry calls. the first one shows the 3 malicious apps & the actual application files.

(10-04-2020, 12:26 PM)miso Wrote: @fritz even though opening the application (even in a controlled environment) helps, try to not load malwares at all since we don't really know what can be in them beforehand