21688
Browser hijacker, C2, cookie theft
autogenerated rule brought to you by yara-signatorMozilla/4.0 MSIE user agent
SHA-2568909090a77cfd0ad0997e66f8e2e49fe6220f29cbb76c0d894663a7824aea89d
Evidence
⋯3 more rows
0x3f000000000000000000000000000000000................
0x40072747274727472747274727472747274rtrtrtrtrtrtrtrt
0x41072747274727472740033000000000000rtrtrtrt.3......
0x420000000313800415f6966000000005f69...18.A_if...._i
0x43066006368726f6d652e65786500666972f.chrome.exe.fir
0x44065666f782e657865006f706572612e65efox.exe.opera.e
0x450786500696578706c6f72652e65786500xe.iexplore.exe.
0x4606300680072006f006d0065002e006500c.h.r.o.m.e...e.
0x47078006500000066006900720065006600x.e...f.i.r.e.f.
0x4806f0078002e00650078006500006f0070o.x...e.x.e..o.p
0x490006500720061002e0065007800650000.e.r.a...e.x.e..
0x4a069006500780070006c006f0072006500i.e.x.p.l.o.r.e.
0x4b02e006500780065000000000000000000..e.x.e.........
0x4c000000000000000000000000000000000................
0x4d000000000000000000000000000474554.............GET
0x4e0200020485454502f312e310d0a486f73 . HTTP/1.1..Hos
0x4f0743a20002676657273696f6e3d005275t: .&version=.Ru
0x5006e00536f6674776172655c4d6963726fn.Software\Micro
0x510736f66745c57696e646f77735c437572soft\Windows\Cur
0x52072656e7456657273696f6e5c4578706crentVersion\Expl
0x5306f7265725c4c6f775265676973747279orer\LowRegistry
0x54000466c6167004765745573657247656f.Flag.GetUserGeo
0x55049440053595354454d5c43757272656eID.SYSTEM\Curren
0x56074436f6e74726f6c5365745c53657276tControlSet\Serv
0x570696365735c73725c506172616d657465ices\sr\Paramete
0x580727300534f4654574152455c4d696372rs.SOFTWARE\Micr
0x5906f736f66745c57696e646f7773204e54osoft\Windows NT
0x5a05c43757272656e7456657273696f6e5c\CurrentVersion\
0x5b053797374656d526573746f7265004669SystemRestore.Fi
0x5c072737452756e0044697361626c655352rstRun.DisableSR
0x5d0005c7573657233322e646c6c007a782e.\user32.dll.zx.
0x5e0646c6c007a0078002e0064006c006c00dll.z.x...d.l.l.
0x5f0000073706f6f6c73762e657865000000..spoolsv.exe...
0x60000002f6d6573736167652e706870002e../message.php..
0x610636f2e6363002e636f2e637a002e696eco.cc..co.cz..in
0x620666f002e6f7267005c757064686c702efo..org.\updhlp.
0x630646174006f70656e002d6e65772d7769dat.open.-new-wi
0x6406e646f7720003c736372697074207372ndow .<script sr
0x650633d22687474703a2f2f002220747970c="http://." typ
0x660653d22746578742f6a61766173637269e="text/javascri
0x6707074223e3c2f7363726970743e00536fpt"></script>.So
0x6806674776172655c4d6963726f736f6674ftware\Microsoft
0x6905c57696e646f77735c43757272656e74\Windows\Current
0x6a056657273696f6e5c4578706c6f726572Version\Explorer
0x6b05c55736572205368656c6c20466f6c64\User Shell Fold
0x78a74653a20005835352046757420323939te: .X55 Fut 299
0x79a39003c2f7469746c653e003c723e003c9.</title>.<r>.<
0x7aa2f723e002a2a687474702533612f2f00/r>.**http%3a//.
0x7ba557365722d4167656e743a2000416363User-Agent: .Acc
0x7ca6570742d456e636f64696e673a200043ept-Encoding: .C
0x7da6f6e74656e742d547970653a20746578ontent-Type: tex
0x7ea742f68746d6c00474554202f73656172t/html.GET /sear
0x7fa636800474554202f733f00676f6f676cch.GET /s?.googl
0x80a652e007365617263682e7961686f6f2ee..search.yahoo.
0x81a636f6d0062696e672e636f6d003f7375com.bing.com.?su
0x82a6269643d002669643d005c74656d702ebid=.&id=.\temp.
0x83a696e69005c7573657233322e646c6c00ini.\user32.dll.
0x84a54696d65476574576f726b0055736573TimeGetWork.Uses
0x85a3332004578697454696d65005665720032.ExitTime.Ver.
0x86a4465636f646500446f6d656e00466c61Decode.Domen.Fla
0x87a6773 gs
0xa7088888888111111111111111100013111..............1.
0xa800001311111111111ee31111111313331..1......1...131
0xa9000000000e11111111111111111111111................
0xaa011111111e11111111111111e4e61bc00............Na..
0xab0000102030405060708090a0b0c0d0e0f................
0xac0101112131415161718191a1b1c1d1e1f................
0xad0202122232425262728292a2b2c2d2e2f !"#$%&'()*+,-./
0xae0303132333435363738393a3b3c3d3e3f0123456789:;<=>?
0xaf0406162636465666768696a6b6c6d6e6f@abcdefghijklmno
0xb00707172737475767778797a5b5c5d5e5fpqrstuvwxyz[\]^_
0xb10606162636465666768696a6b6c6d6e6f`abcdefghijklmno
0xb20707172737475767778797a7b7c7d7e7fpqrstuvwxyz{|}~.
0xb30808182838485868788898a8b8c8d8e8f................
0xb40909192939495969798999a9b9c9c9e9f................
0xb50a0a1a2a3a4a5a6a7a8a9aaabacadadaf................
0xb60b0b1b2b3b4b5b6b7b8b9babbbcbdbebf................
0xb70c0c1c2c3c4c5c6c7c8c9cacbcccdcecf................
0xb80d0d1d2d3d4d5d6d7d8d9dadbdcdddedf................
0xb90e0e1e2e3e4e5e6e7e8e9eaebecedeeef................
0xba0f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff................
0xbb03c683320636c6173733d2272223e3c61<h3 class="r"><a
0xbc020687265663d22687474703a2f2f003c href="http://.<
0xbd0683320636c6173733d723e3c61206872h3 class=r><a hr
0xbe065663d22687474703a2f2f003c6833 ef="http://.<h3
0x190b75086a00ff1511200010c9c20400558bu.j.... ......U.
0x191bec68008000006a00ff7508ff15152000.h....j..u.... .
0x192b10c9c20400558becff75086a40ff157d.....U...u.j@..}
0x193b200010c9c20400558becff7508ff1581 ......U...u....
0x194b200010c9c20400558bec528b5508b800 ......U..R.U...
0x195b000000803a00740883c20183c001ebf3....:.t.........
0x196b5ac9c20400558bec83c4fc5152535756Z....U.....QRSWV
0x197bff7510e8cfffffff8945fc8b750c8bde.u.......E..u...
0x198b035d14ff4d0803750833c033c94e8b55.]..M..u.3.3.N.U
0x199bfc8b7d102bf133c983c6013bf3742a8a..}.+.3....;.t*.
0x19ab278a0638e07406042038e075e183c701'..8.t.. 8.u....
0x19bb83c1014a75e28b55fc2bf283c6018bc6...Ju..U.+......
0x19cb5e5f5b5a59c9c2100033c05e5f5b5a59^_[ZY....3.^_[ZY
0x19dbc9c21000558bec83c4fc515253575683....U.....QRSWV.
0x19eb7d0c0074538b750c8bde035d1033c033}..tS.u....].3.3
0x19fbc9ff4d080375084e8b55188955fc8b7d..M..u.N.U..U..}
0x1a0b142bf133c983c6013bf3742c8a178a06.+.3....;.t,....
0x1a1b38d07406042038d075de83c70183c1018.t.. 8.u.......
0x1a2bff4dfc75e08b55182bf283c6018bc65e.M.u..U.+......^
0x1a3b5f5b5a59c9c2140033c05e5f5b5a59c9_[ZY....3.^_[ZY.
0x1a4bc21400558bec83c4fc5152535756837d...U.....QRSWV.}
0x1a5b0c00744d8b750c8bde035d1033c033c9..tM.u....].3.3.
0x1a6bff4d080375084e8b55188955fc8b7d14.M..u.N.U..U..}.
0x1a7b2bf133c983c6013bf374268a178a0638+.3....;.t&....8
0x1a8bd075e483c70183c101ff4d .u........M
0x1b708919668951048d45fc50ff75fc6a06ff..f.Q..E.P.u.j..
0x1b80750cff1519200010ba05000000bb0000u.... ..........
0x1b9000008b750ceb12e8d9faffff83f8ff75...u...........u
0x1ba004eb73eb0403d803f03bda72ea8d45fc..s......;.r..E.
0x1bd000108b4d1089018bf88b750c8bcbf3a4...M......u.....
0x1be0c607e98b4d0c2bc883e905894f018b7d....M.+.....O..}
0x1bf00cc607e98b4d082b4d0c83e905894f01.....M.+M.....O.
0x1c008d45fc50ff75fc53ff750cff15192000.E.P.u.S.u.... .
0x1c10108b45108b10c9c21400558becff750c..E.......U...u.
0x1c2068061c0010ff75086a01e841fdffff0bh.....u.j..A....
0x1c30c07506c9c20800eb0e83c0108b4d0889.u...........M..
0x1c4045082bc129450cff750c68401c0010ffE.+.)E..u.h@....
0x1c5075086a01e817fdffff83f8007429c700u.j.........t)..
0x1c606e6f6e658bc82b4d08294d0cff750c68none..+M.)M..u.h
0x1c70401c0010506a05e8f4fcffff83f80074@...Pj.........t
0x1c8006c7006e6f6e65803d661e001004751c...none.=f....u.
0x1c90ff750c68451c0010ff75086a01e8cefc.u.hE....u.j....
0x1ca0ffff0bc07406c7006e6f6e65c9c20800....t...none....
0x1cb0558becff750c684f1c0010ff75086a01U...u.hO....u.j.
0x1cc0e8abfcffff83f800740683c007c60030........t......0
0x1cd0c9c20800558bec518b4d108b7d088b75....U..Q.M..}..u
0x1ce00cf3a459c9c20c00558becff7510e80d...Y....U...u...
0x1cf0fcffff0bc0741a50ff750cff750850e8.....t.P.u..u.P.
0x1d00d0ffffffff7508e80dfcffff58c9c20c.....u......X...
0x1d1000b8ffffffffc9c20c00558bec8b4d0c..........U...M.
0x1d208b7d088a073c3972083c7e77042c19eb.}...<9r.<~w.,..
0x1d30133c20720f3c38770b2c1fb47e02e080.< r.<8w.,..~...
0x1d40ec198ac4880783c701e2d8c9c2080055...............U
0x1d508becff152f210010c9c20800558bec83..../!......U...
0x1d60c4f8c745fc000000008d45fc506a016a...E......E.Pj.j
0x1d7000ff750cff7508ff158c2100100bc00f..u..u....!.....
0x1d808594000000837d14017406837d140375......}..t..}..u
0x1d904a8d45f8506a006a006a00ff7510ff75J.E.Pj.j.j..u..u
0x1da0fcff159421001083f800756d8b45f883....!.....um.E..
0x1db0c00150e848fbffff8b4d1889018bc88d..P.H....M......
0x1dc045f850516a006a00ff7510ff75fcff15E.PQj.j..u..u...
0x1dd09421001083f8007540eb29837d140475.!.....u@.).}..u
0x1de023c745f8040000008d45f850ff75186a#.E......E.P.u.j
0x1df0006a00ff7510ff75fcff159421001083.j..u..u....!...
0x1e00f8007515ff75fcff1588210010b80100..u..u....!.....
0x1e1000008b4df8c9c21400b800000000c9c2...M............
0x1e201400558bec83c4fc6a008d45fc506a00..U.....j..E.Pj.
0x1e306a026a008d4514506a00ff750cff7508j.j..E.Pj..u..u.
0x1e40ff15902100100bc07554837d14017406...!....uT.}..t.
0x1e50837d14037519ff751cff7518ff75146a.}..u..u..u..u.j
0x1e6000ff7510ff75fcff1598210010eb1d83..u..u....!.....