Sample viewer

vx.netlux.org/Virus.DOS.Tarazona.985

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:05:34.813886811Z 190 PC: 12ab6 | UNKNOWN!
2018-12-17T23:05:34.815527607Z 53 PC: 12ac2 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:05:34.817658864Z 74 PC: 12adf | Reallocate memory
2018-12-17T23:05:34.819292716Z 72 PC: 12ae6 | Allocate memory
2018-12-17T23:05:34.821106507Z 37 PC: 12b0b | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:05:34.823292948Z 42 PC: 12b0f | Get date 0x12b0f: cmp dh, 0xa
0x12b12: jne 0x12b29
0x12b14: cmp dl, 0xa
0x12b17: jne 0x12b29
0x12b19: mov ax, 0
0x12b1c: int 0x10
0x12b1e: mov ax, 0x900
0x12b21: lea dx, word ptr [bp + 0x409]
0x12b25: int 0x21
0x12b27: jmp 0x12b27
0x12b29: xor bp, bp
0x12b2b: pop ds
0x12b2c: pop es
0x12b2d: pop di
0x12b2e: pop si
0x12b2f: pop dx
0x12b30: pop cx
0x12b31: pop bx
0x12b32: pop ax
0x12b33: push ax
2018-12-17T23:05:34.825935187Z 76 PC: 12a4b | Terminate with return code (Return code = '0')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":15254,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:42:59.707181977Z 190 PC: 12ab6 | UNKNOWN!
2018-12-25T12:42:59.70861714Z 53 PC: 12ac2 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:42:59.709861029Z 74 PC: 12adf | Reallocate memory
2018-12-25T12:42:59.711455758Z 72 PC: 12ae6 | Allocate memory
2018-12-25T12:42:59.713220154Z 37 PC: 12b0b | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:42:59.719100388Z 42 PC: 12b0f | Get date 0x12b0f: cmp dh, 0xa
0x12b12: jne 0x12b29
0x12b14: cmp dl, 0xa
0x12b17: jne 0x12b29
0x12b19: mov ax, 0
0x12b1c: int 0x10
0x12b1e: mov ax, 0x900
0x12b21: lea dx, word ptr [bp + 0x409]
0x12b25: int 0x21
0x12b27: jmp 0x12b27
0x12b29: xor bp, bp
0x12b2b: pop ds
0x12b2c: pop es
0x12b2d: pop di
0x12b2e: pop si
0x12b2f: pop dx
0x12b30: pop cx
0x12b31: pop bx
0x12b32: pop ax
0x12b33: push ax
2018-12-25T12:42:59.720593211Z 76 PC: 12a4b | Terminate with return code (Return code = '0')

{"DateBased":true,"Day":1,"Month":10,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":15254,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:42:59.961855504Z 190 PC: 12ab6 | UNKNOWN!
2018-12-25T12:42:59.96324305Z 53 PC: 12ac2 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:42:59.965574813Z 74 PC: 12adf | Reallocate memory
2018-12-25T12:42:59.967738688Z 72 PC: 12ae6 | Allocate memory
2018-12-25T12:42:59.97008506Z 37 PC: 12b0b | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:42:59.971935837Z 42 PC: 12b0f | Get date 0x12b0f: cmp dh, 0xa
0x12b12: jne 0x12b29
0x12b14: cmp dl, 0xa
0x12b17: jne 0x12b29
0x12b19: mov ax, 0
0x12b1c: int 0x10
0x12b1e: mov ax, 0x900
0x12b21: lea dx, word ptr [bp + 0x409]
0x12b25: int 0x21
0x12b27: jmp 0x12b27
0x12b29: xor bp, bp
0x12b2b: pop ds
0x12b2c: pop es
0x12b2d: pop di
0x12b2e: pop si
0x12b2f: pop dx
0x12b30: pop cx
0x12b31: pop bx
0x12b32: pop ax
0x12b33: push ax
2018-12-25T12:42:59.97507329Z 76 PC: 12a4b | Terminate with return code (Return code = '0')

{"DateBased":true,"Day":10,"Month":10,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":15254,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:43:00.103660698Z 190 PC: 12ab6 | UNKNOWN!
2018-12-25T12:43:00.104389645Z 53 PC: 12ac2 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:43:00.105545111Z 74 PC: 12adf | Reallocate memory
2018-12-25T12:43:00.119018531Z 72 PC: 12ae6 | Allocate memory
2018-12-25T12:43:00.120150726Z 37 PC: 12b0b | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:43:00.120964719Z 42 PC: 12b0f | Get date 0x12b0f: cmp dh, 0xa
0x12b12: jne 0x12b29
0x12b14: cmp dl, 0xa
0x12b17: jne 0x12b29
0x12b19: mov ax, 0
0x12b1c: int 0x10
0x12b1e: mov ax, 0x900
0x12b21: lea dx, word ptr [bp + 0x409]
0x12b25: int 0x21
0x12b27: jmp 0x12b27
0x12b29: xor bp, bp
0x12b2b: pop ds
0x12b2c: pop es
0x12b2d: pop di
0x12b2e: pop si
0x12b2f: pop dx
0x12b30: pop cx
0x12b31: pop bx
0x12b32: pop ax
0x12b33: push ax
2018-12-25T12:43:00.127421369Z 9 PC: 12b27 | Display string (String= 'Tranquilo chico que si no es en septiembre ser� en Junio :-) Que los 12 cr�ditos m�nimos te acompa�en ..... by nEUrOtIc cPu cOrpOrAtIOn S.A. ')