User Infecting #Report 1

[ToneXfield]

Title:NetGhost v.1.4 Proxy Grabber and Checker

User Name:MyWifeaMyComptr

UID:2406283

User Profile:https://www.nulled.t...mywifeamycomptr

Used Diff VT link which was clean 

VT link he used: 

Please Login or Register to see this Hidden Content

 

Sample:

[hide]

Please Login or Register to see this Hidden Content

[/hide]

 

 

Infected with NanoCore IP: 127.0.0.1:3218

fojasoftwareaudio.ignorelist.com port 3218

Please Login or Register to see this Hidden Content

HTTPS REQUEST

.pastebin.com

GET /raw/7kcDT0fn HTTP/1.1

GET /raw/VAyUNc0W HTTP/1.1

Please Login or Register to see this Hidden Content

Please Login or Register to see this Hidden Content

-------------------------------------------------

 

fojasoftwareaudio.ignorelist.com

response: NXDOMAIN

https://www.virustot...ist.com/details

 

creates new folder

file: mggdfd.exe.bat

C:\Users\user\AppData\Local\Temp\iuytuyt\mggdfd.exe.bat

(md5: e6f4e34683764b280b18c5c2fd242959)

Please Login or Register to see this Hidden Content

create new file

melt.bat

C:\Users\user\AppData\Local\Temp\iuytuyt\melt.bat

(md5: e37e452eba99d96f0333f21ec7b00295)

Please Login or Register to see this Hidden Content

create new file

file NetGhost v1.4.0.0.exe

C:\Users\user\AppData\Local\Temp\NetGhost v1.4.0.0.exe
C:\Users\user\AppData\Local\Temp\iuytuyt\mggdfd.exe

(md5: 5cdbe3705956b9cf95e30da13d6ff178)

create new file

NetGhost_Latest.zip

C:\Users\user\AppData\Local\Temp\NetGhost_Latest.zip

(md5: d41d8cd98f00b204e9800998ecf8427e)

create new file

GDIPFONTCACHEV1.DAT

C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DAT

(md5: 1bba2e8a1b56ec52dd7805093b4839d3)

 

create  new file

tbdadf.exe

C:\Users\user\AppData\Local\Temp\tbdadf.exe

(md5: 2e5f1cf69f92392f8829fc9c9263ae9b)

create new file

NG 1.4.exe

C:\Users\user\AppData\Local\Temp\NG 1.4.exe

(md5: 12189a91572eb3b56ada659ad4f57752)

Edited by ToneXfield, 03 June 2019 - 04:11 PM.

[KiburiciSlave]

Title:NetGhost v.1.4 Proxy Grabber and Checker

User Name:MyWifeaMyComptr

UID:2406283

User Profile:https://www.nulled.t...mywifeamycomptr

Used Diff VT link which was clean 

VT link he used: 

Please Login or Register to see this Hidden Content

 

Infected Do not not not download:

 

 

 

Infected with NanoCore IP: 127.0.0.1:3218

fojasoftwareaudio.ignorelist.com port 3218

Please Login or Register to see this Hidden Content

HTTPS REQUEST

.pastebin.com

GET /raw/7kcDT0fn HTTP/1.1

GET /raw/VAyUNc0W HTTP/1.1

Please Login or Register to see this Hidden Content

Please Login or Register to see this Hidden Content

-------------------------------------------------

 

fojasoftwareaudio.ignorelist.com

response: NXDOMAIN

https://www.virustot...ist.com/details

 

creates new folder

file: mggdfd.exe.bat

C:\Users\user\AppData\Local\Temp\iuytuyt\mggdfd.exe.bat

(md5: e6f4e34683764b280b18c5c2fd242959)

Please Login or Register to see this Hidden Content

create new file

melt.bat

C:\Users\user\AppData\Local\Temp\iuytuyt\melt.bat

(md5: e37e452eba99d96f0333f21ec7b00295)

Please Login or Register to see this Hidden Content

create new file

file NetGhost v1.4.0.0.exe

C:\Users\user\AppData\Local\Temp\NetGhost v1.4.0.0.exe
C:\Users\user\AppData\Local\Temp\iuytuyt\mggdfd.exe

(md5: 5cdbe3705956b9cf95e30da13d6ff178)

create new file

NetGhost_Latest.zip

C:\Users\user\AppData\Local\Temp\NetGhost_Latest.zip

(md5: d41d8cd98f00b204e9800998ecf8427e)

create new file

GDIPFONTCACHEV1.DAT

C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DAT

(md5: 1bba2e8a1b56ec52dd7805093b4839d3)

 

create  new file

tbdadf.exe

C:\Users\user\AppData\Local\Temp\tbdadf.exe

(md5: 2e5f1cf69f92392f8829fc9c9263ae9b)

create new file

NG 1.4.exe

C:\Users\user\AppData\Local\Temp\NG 1.4.exe

(md5: 12189a91572eb3b56ada659ad4f57752)

I downloaded that hsit man fuck of oooof

[ToneXfield]

I downloaded that hsit man fuck of oooof

i reported the thread but just incase he removes everything i have here displayed don't download unless you want the sample.

[zelus]

Nice one OP.

 

Good work.