Trojan.MSIL.Clicker.CCI
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.MSIL.Clicker.CCI |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
716493bced95dce2eaca7c88c16dcff5
SHA1:
69223ecba2fc3a095682ccd275ae3a8351baccc6
SHA256:
42AF741A8F94BC097F4138DDE48D994E48043240209826B341162B1A36EB01BD
File Size:
8.98 MB, 8978432 bytes
|
|
MD5:
c2a41618c5926fce9ed502289a87248d
SHA1:
ebf1df78278217fd580c61e0613329ea4079d030
SHA256:
DA6FA25166D31EB64CC4E7772D610D9906792456BB1D122C8B0B507B462AB9D7
File Size:
7.78 MB, 7783424 bytes
|
|
MD5:
ad680d0671f7d5263cf7aa2c48a4e64a
SHA1:
fcc90f63d1844225330be579136c48331c624d4b
SHA256:
A6EA4DDFEDD9B72DCC599F107DD9BC981DC19C9D1A262FCDE105DD4B7E986DA1
File Size:
18.43 KB, 18432 bytes
|
|
MD5:
4b604bdc216069c57adc62ed8ddd05cf
SHA1:
c0a7e41f66a2e684f8e34bc65d0375105b590b8c
SHA256:
D9EA1CF8AFB86DDBF48BB87F8A5FE97270F0FA99D30C54DC0483747B021FD044
File Size:
7.48 MB, 7475200 bytes
|
|
MD5:
b6fb776bfb8c15f826e61e06c7c1cde1
SHA1:
f41bfe2d6fe5e7c6e0544f05918e3668f7919073
SHA256:
8B1057190206C6810781E64F47F765837C95CE27E8DDA8AAD402BCF2DA014537
File Size:
7.50 MB, 7503872 bytes
|
Show More
|
MD5:
3b53dba56fba1186631d32372825b509
SHA1:
69409a0171165f04b113dfc3a558671ad7d9e97e
SHA256:
90EF401E3AFD00596717FEB77DC743BE9C7ABCCFFE347B37D04869139A92E3B2
File Size:
8.88 MB, 8881152 bytes
|
|
MD5:
680dae1e772d875b9bc8bed6983ad083
SHA1:
d4a3bab37ddb4120e8df93c5db8f9e093d1f42f1
SHA256:
EF453F0F43A173B615A788AC5DADDF06275794258D849D3FAD447BBB730271F0
File Size:
21.50 KB, 21504 bytes
|
|
MD5:
1165c6cee44321f8c24dd4c25c4710d5
SHA1:
ed245c9749734e55aac3149db2364c92f3aa0d26
SHA256:
F55ADCDD2B1B48228AD84CA861A5DD0BA6833A1649AD595201B99790CF07FB5C
File Size:
7.41 MB, 7413248 bytes
|
|
MD5:
2c0672de9eb0e0d057f3dd410d0408d9
SHA1:
5bee4dcffef7f80b89e6ffc1c3a188204523e038
SHA256:
D471EF6A919811C41A28D74F88AB3A5A0BEEFDFE49105CEFB80D48DD1AE4E981
File Size:
19.46 KB, 19456 bytes
|
|
MD5:
732ecfd30e7ba955ed2e2ef7a7a56a81
SHA1:
824a605168ae4f1b07c1ddeee55c300327ab2994
SHA256:
2F2A735CC7B0B47FA1874E37A2CDEDCC7A16C04423179BF3E8F1B23B5039EF78
File Size:
8.97 MB, 8972288 bytes
|
|
MD5:
5ebb1959c8ca316c4d6fb2cf0fa7948f
SHA1:
cabf3671da5416340b2b1dca831ad792d8be691a
SHA256:
77E308938BB6C154F22ED8454D969A861D40AEDE5BECB1355A00DBFBB3615554
File Size:
18.94 KB, 18944 bytes
|
|
MD5:
b3b4548983f350a31d15d238ab8dc49c
SHA1:
062e34b0676a3a2339fb746cc0fdb2bc8a5c88f8
SHA256:
11DC0CDD6EBDF0D123FE71ED6624030DBEBE114A0FDDA6BCC3EE2CA2F375BD64
File Size:
7.47 MB, 7469056 bytes
|
|
MD5:
619f7cd91469392432ca1b6e3337aee8
SHA1:
c645d2f10ca61b91ba1cdc8e74748c4d6cdc9fcb
SHA256:
A5FB5F43D82A1577B640F435024D7846BE9FC599119D7E49EA9DF5DC7830F507
File Size:
8.25 MB, 8253952 bytes
|
|
MD5:
437b9dd38a4ea23414d57072a110c908
SHA1:
b6c1620fa0621a6a565aa392129d3fe19f511b03
SHA256:
1B0359C0D513FB9D0475C60EC7C5720BADC875A8BFD10379B5E9D544AFC08CE9
File Size:
7.94 MB, 7940096 bytes
|
|
MD5:
41b0839a470c3f0c800253c5f342bbd2
SHA1:
8dbbd429dcd9f018c720f2cd4bcb308ab5536274
SHA256:
4A91BD3707B6DA995A9765639E69F7A6F99E5CAA57F9075792E121E8995CA734
File Size:
18.94 KB, 18944 bytes
|
|
MD5:
470992c6266d74f930181c3518bdfed4
SHA1:
c22b05d517fb03c64fed21bd5144c74faf54aaa4
SHA256:
9EE9B8A4910E052C94FDADB2B77A25EC98E93C23F66B1DC60FDCFF6434CB819F
File Size:
8.17 MB, 8170496 bytes
|
|
MD5:
2afbba0fe32140bfffa66dc7c68f3c61
SHA1:
dd5b041274151123760f961c12998a3b1e4622a4
SHA256:
81D224EE2692EA912FE33AB34C26C132740F6EAB1F0B136B1AC2D10FDDB08B69
File Size:
7.78 MB, 7780352 bytes
|
|
MD5:
f474703b0cc2201cb96c1f84e3b32a3c
SHA1:
6e83095967f4f04c91cbae69192eb6f833841cb4
SHA256:
1EC12A0C65DDCD468BCAE0DA083703ADD6D9A93FA3CD3351A71C8038E9A17B13
File Size:
8.41 MB, 8412160 bytes
|
|
MD5:
69657cae795722a6ee243061dd66e13f
SHA1:
bbd6cab28ddc0c93f1a1c2186695008d42448a75
SHA256:
6FA1E1780FD453C7CEEFE21872C04A239490F9081B7D1AB3F1FF92E2AEEF2FD4
File Size:
8.07 MB, 8068096 bytes
|
|
MD5:
7a99f0cb382e4a32d2b9fc1f67ad3d08
SHA1:
9e78cb6250a526edd21d2a35ab0c54c5ad02bc35
SHA256:
03C377CCCF9BFC31F8652A3E7A8F4CAC634250161714FC92DD782CF3D9B3A4F1
File Size:
7.53 MB, 7533568 bytes
|
|
MD5:
062dbdfc8c53c83018d0de3c47b959b2
SHA1:
412eedfdb6060575a1cc4b7a218011ad5c4e812d
SHA256:
FE9419050E6239A017D5055B3C5832C57372838B6710A87EC9A201C6C35837DA
File Size:
8.06 MB, 8058368 bytes
|
|
MD5:
50e1e0a0fd447669db2480631e408c89
SHA1:
482c3c866997d44129610fc47c4a0167bcce5476
SHA256:
6F59EA9B0F9C9CEC221BC4A9A6B2122457DDCD7EC8189C1EA1FB0F4927C7C90D
File Size:
18.43 KB, 18432 bytes
|
|
MD5:
3d9d431d9447e5e1a9742df2a19a1048
SHA1:
4c19c25b3b6b6bdd62c1635af72f331bfa4629f0
SHA256:
453820FE2FB2B3D1AB668E38AC22C1F788656F10B59EBD3F4CB2D198A8E56B3D
File Size:
18.94 KB, 18944 bytes
|
|
MD5:
db24148ee217a72cfc5df32cb4f4d635
SHA1:
85fc1b75ec717c1ef33bc8531e77d2417140af68
SHA256:
123E1FF4F0B6A3F34AECE9E8B8619C086521F5B6457A842B4B77A8E6E9CB6136
File Size:
8.14 MB, 8135680 bytes
|
|
MD5:
bd10fd526b993b10d05ca94115df1cd6
SHA1:
9557be06b05e867f64b307d2ba5542ea0f6477cf
SHA256:
E46C00C46A91B91E16338A2CCCFCF5585CEC4DC67ADCBE72FE3235EFBAEA7936
File Size:
9.37 MB, 9365504 bytes
|
|
MD5:
f99b0b41d1b2c15c20443973bc4e414d
SHA1:
da614544e01afd7330b1343daf361258952b1f05
SHA256:
F0670FDA1CE20764F434194A4A09ED4834D6E24473950D2016881343CD4AB4FE
File Size:
9.57 MB, 9574912 bytes
|
|
MD5:
dd7b55447d50d305f494a684d15a8bc9
SHA1:
86f3a18bc308d65a9b31f989c103607b0ab72e90
SHA256:
2D9ED830A1E0050A2240521CB69DE055E42D131D8AD81A6950ADB9625AD981FB
File Size:
9.65 MB, 9645568 bytes
|
|
MD5:
d0e38cbcbede7aa6675c4c5c3c393e81
SHA1:
38b4d449df9588779fa52d7e459c694cee32c6a8
SHA256:
04ECDBB00FFD0BA7D7F1627B44215E65DC26DD49FC460919E1FF2B119F1EAF4F
File Size:
8.07 MB, 8071680 bytes
|
|
MD5:
95070a0a9bb597625119ff02fcaa8596
SHA1:
399973704f358081e148997fedddbc9afca62258
SHA256:
D063F0A1FC16D2E845C3DDB5B4C8AE15E06FA108843EE44A6B525747459113CD
File Size:
8.09 MB, 8093696 bytes
|
|
MD5:
ea465c882f0958a4294e144e1b8373a9
SHA1:
c2146efdfe4cb2ea946100481f0e2cc33cdf4b74
SHA256:
31A067C4577DB00BE3CED0B9C399E276A6F60E003AF3B8AAD4E10B4EEFAF5DCD
File Size:
9.52 MB, 9524736 bytes
|
|
MD5:
4764947f0acc85a84c4712481feb0b36
SHA1:
43417a3338b2359cabe885f9722b00d09c976955
SHA256:
68168B431D63F0D6A3CD208956B3E6AE6F646D4376929DC10A7F3880CCD9DA7A
File Size:
8.67 MB, 8670720 bytes
|
|
MD5:
735d14aa7da0d06f8c332b72fa98bfc2
SHA1:
550766f5b07a4ebfaf37aef23986c994eac2ddcf
SHA256:
4A1CA9CABAF53BD775C7C2E3F264259C770340637EF3EA2598491E6A3AEA4FC3
File Size:
19.46 KB, 19456 bytes
|
|
MD5:
167857944b326d2382c5a87012ced1fe
SHA1:
781d4fba1a097f2c601606c3b5f7245328ed74f2
SHA256:
6E58BBCACADAD915E4EC35987126A387E85DF5BAE6F67423C51C288F70682968
File Size:
7.79 MB, 7790080 bytes
|
|
MD5:
3a3ee885136a9bfd8e5a0fdbb44e32c7
SHA1:
de046a51aa8006c7e947a791575c3dfaeadfc88a
SHA256:
8244015A2FEF273A088628C5E94372C6C3CD875676A49AFC9BA764A2BEB85BDC
File Size:
5.97 MB, 5971267 bytes
|
|
MD5:
c198dcf253e76c48e5e4c2a533237aed
SHA1:
4c7fe91eecfea91f37a50dd2380a28d119824202
SHA256:
E60ADF70F865066BFE0A29F9EDBFAA7A59FE5C25E8128814774387C8D27D62A2
File Size:
7.70 MB, 7698944 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File is .NET application
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version | 1.0.0.0 |
| Comments |
Show More
|
| Company Name |
Show More
|
| File Description |
Show More
|
| File Version |
|
| Internal Name |
Show More
|
| Legal Copyright |
|
| Original Filename |
Show More
|
| Product Name |
Show More
|
| Product Version |
|
File Traits
- .NET
- HighEntropy
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 131 |
|---|---|
| Potentially Malicious Blocks: | 42 |
| Whitelisted Blocks: | 58 |
| Unknown Blocks: | 31 |
Visual Map
x
?
x
x
x
0
0
x
?
x
?
0
0
x
?
0
0
?
?
0
0
x
?
x
?
?
x
0
?
x
x
?
0
x
0
0
0
?
0
0
x
0
0
0
x
0
x
?
0
0
0
0
x
0
0
x
?
x
?
0
0
x
?
x
?
0
0
?
?
0
0
x
x
0
0
x
0
x
0
0
?
0
0
?
0
x
x
0
x
0
0
x
0
0
x
0
?
x
?
x
0
?
?
x
x
?
0
0
0
x
x
?
0
0
?
0
0
x
0
0
x
0
x
x
x
?
0
x
?
?
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- MSIL.Dropper.YCE
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe | Generic Read,Write Attributes |
| \device\namedpipe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsjb905.tmp\nsexec.dll | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | Ꟁễ넚ǜ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| User Data Access |
|
| Encryption Used |
|
| Anti Debug |
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Zyxcxqsn\AppData\Local\""
|