Sample viewer

vx.netlux.org/Trojan.DOS.QHA.d

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:44:58.800454701Z 48 PC: 17fa2 | Get DOS version
2018-12-17T22:44:58.802819094Z 74 PC: 17ff2 | Reallocate memory
2018-12-17T22:44:58.804976919Z 48 PC: 17d7e | Get DOS version
2018-12-17T22:44:58.806053589Z 53 PC: 17d86 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:44:58.808836157Z 37 PC: 17d98 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:44:58.810647298Z 53 PC: 1a562 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:44:58.811786339Z 37 PC: 1a572 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:44:58.813893157Z 53 PC: 1a577 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:44:58.815036503Z 37 PC: 1a587 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:44:58.816409644Z 53 PC: 182b6 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:44:58.817898071Z 53 PC: 182b6 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:44:58.819207028Z 53 PC: 182b6 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:44:58.820254836Z 53 PC: 182b6 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:44:58.822087784Z 53 PC: 182b6 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:44:58.823560326Z 53 PC: 182b6 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:44:58.82450757Z 53 PC: 182b6 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:44:58.825930286Z 53 PC: 182b6 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:44:58.831644055Z 53 PC: 182b6 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:44:58.832942135Z 53 PC: 182b6 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:44:58.834571407Z 53 PC: 182b6 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:44:58.841943545Z 37 PC: 182e5 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:44:58.842874122Z 37 PC: 182e5 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:44:58.844166925Z 37 PC: 182e5 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:44:58.845682103Z 37 PC: 182e5 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:44:58.846590075Z 37 PC: 182e5 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:44:58.847778218Z 37 PC: 182e5 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:44:58.84932282Z 37 PC: 182e5 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:44:58.850760708Z 37 PC: 182e5 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:44:58.851789407Z 37 PC: 182ec | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:44:58.853086936Z 37 PC: 182f1 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:44:58.854277501Z 68 PC: 17e29 | I/O control for devices (Set for = '�����r�f�_^�p]�.���+�r�- ')
2018-12-17T22:44:58.855628544Z 68 PC: 17e29 | I/O control for devices
2018-12-17T22:44:58.857218846Z 68 PC: 17e29 | I/O control for devices (Set for = 'riable required')
2018-12-17T22:44:58.858250534Z 68 PC: 17e29 | I/O control for devices (Set for = 'IELD overflow')
2018-12-17T22:44:58.859465239Z 68 PC: 17e29 | I/O control for devices (Set for = 'IELD overflow')
2018-12-17T22:44:58.86101599Z 53 PC: 15b48 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:44:58.862469613Z 53 PC: 15b55 | Get interrupt vector (Interrupt = '4' AKA 'Auxiliary output')
2018-12-17T22:44:58.868351662Z 53 PC: 15b62 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:44:58.877052857Z 37 PC: 15b77 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:44:58.87874624Z 37 PC: 15b7f | Set interrupt vector (Interrupt = '4' AKA 'Auxiliary output')
2018-12-17T22:44:58.897581652Z 37 PC: 15b87 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:44:58.899339502Z 53 PC: 160c0 | Get interrupt vector (Interrupt = '239' AKA 'UNKNOWN!')
2018-12-17T22:44:58.900782807Z 53 PC: 160cd | Get interrupt vector (Interrupt = '240' AKA 'UNKNOWN!')
2018-12-17T22:44:58.902528167Z 53 PC: 160dc | Get interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-17T22:44:58.904376246Z 37 PC: 160e9 | Set interrupt vector (Interrupt = '239' AKA 'UNKNOWN!')
2018-12-17T22:44:58.905669743Z 53 PC: 160f0 | Get interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-17T22:44:58.907158113Z 37 PC: 160fd | Set interrupt vector (Interrupt = '240' AKA 'UNKNOWN!')
2018-12-17T22:44:58.908926044Z 53 PC: 16109 | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-17T22:44:58.912953916Z 48 PC: 161cb | Get DOS version
2018-12-17T22:44:58.914300284Z 74 PC: 1736b | Reallocate memory
2018-12-17T22:44:58.916271819Z 74 PC: 1736b | Reallocate memory
2018-12-17T22:44:58.917531018Z 68 PC: 15abe | I/O control for devices (Set for = 'd!')
2018-12-17T22:44:58.918788884Z 68 PC: 15abe | I/O control for devices (Set for = '')
2018-12-17T22:44:58.920497008Z 51 PC: 15adc | Get or set Ctrl-Break
2018-12-17T22:44:58.921614374Z 51 PC: 15ae8 | Get or set Ctrl-Break
2018-12-17T22:44:58.925456755Z 61 PC: 131a6 | Open file (Filename = 'C:\WINDOWS\SYSTEM\QHA.PRT')
2018-12-17T22:44:58.936968782Z 60 PC: 1306b | Create or truncate file
2018-12-17T22:44:59.276088972Z 62 PC: 147bb | Close file
2018-12-17T22:44:59.278339645Z 61 PC: 131a6 | Open file (Filename = 'C:\WINDOWS\SYSTEM\QHA.PRT')
2018-12-17T22:44:59.287424859Z 68 PC: 130ff | I/O control for devices (Set for = '6')
2018-12-17T22:44:59.28999081Z 66 PC: 1455d | Move file pointer
2018-12-17T22:44:59.291383181Z 63 PC: 14784 | Read file or device (Read 50 bytes on handle 5)
2018-12-17T22:44:59.294542358Z 62 PC: 147bb | Close file
2018-12-17T22:44:59.296751083Z 25 PC: 12c79 | Get default drive
2018-12-17T22:44:59.297826093Z 13 PC: 12c7e | Disk reset
2018-12-17T22:44:59.2999361Z 14 PC: 12c85 | Set default drive (Drive = 'A')
2018-12-17T22:44:59.306608536Z 74 PC: 1736b | Reallocate memory
2018-12-17T22:44:59.308066893Z 51 PC: 15af3 | Get or set Ctrl-Break
2018-12-17T22:44:59.309738378Z 37 PC: 15d75 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:44:59.311355607Z 37 PC: 15d7f | Set interrupt vector (Interrupt = '4' AKA 'Auxiliary output')
2018-12-17T22:44:59.312865782Z 37 PC: 15d89 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:44:59.314855563Z 53 PC: 14850 | Get interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-17T22:44:59.316316507Z 53 PC: 1485d | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-17T22:44:59.317655068Z 53 PC: 1486a | Get interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-17T22:44:59.319835Z 37 PC: 14885 | Set interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-17T22:44:59.321001005Z 53 PC: 1488d | Get interrupt vector (Interrupt = '239' AKA 'UNKNOWN!')
2018-12-17T22:44:59.322149672Z 37 PC: 1489a | Set interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-17T22:44:59.323390045Z 53 PC: 148a1 | Get interrupt vector (Interrupt = '240' AKA 'UNKNOWN!')
2018-12-17T22:44:59.327044473Z 37 PC: 148ae | Set interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-17T22:44:59.328163821Z 37 PC: 148b8 | Set interrupt vector (Interrupt = '239' AKA 'UNKNOWN!')
2018-12-17T22:44:59.329262747Z 37 PC: 148c3 | Set interrupt vector (Interrupt = '240' AKA 'UNKNOWN!')
2018-12-17T22:44:59.331628809Z 37 PC: 18301 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:44:59.333446599Z 37 PC: 18301 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:44:59.33561078Z 37 PC: 18301 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:44:59.338055679Z 37 PC: 18301 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:44:59.339492034Z 37 PC: 18301 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:44:59.340935611Z 37 PC: 18301 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:44:59.342848722Z 37 PC: 18301 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:44:59.343922709Z 37 PC: 18301 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:44:59.345790374Z 37 PC: 18301 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:44:59.347428263Z 37 PC: 18301 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:44:59.348646108Z 37 PC: 18301 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:44:59.349676965Z 37 PC: 1a596 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:44:59.35152897Z 37 PC: 17eda | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:44:59.353592154Z 41 PC: 17bfd | Parse filename
2018-12-17T22:44:59.354910414Z 41 PC: 17bff | Parse filename
2018-12-17T22:44:59.356764021Z 41 PC: 17c04 | Parse filename
2018-12-17T22:44:59.358068386Z 75 PC: 17c1a | Execute program
2018-12-17T22:44:59.383499633Z 80 PC: 1d489 | Set current PSP
2018-12-17T22:44:59.384991484Z 48 PC: 1d48e | Get DOS version
2018-12-17T22:44:59.386418906Z 99 PC: 23c70 | Get DBCS lead byte table pointer
2018-12-17T22:44:59.388831024Z 101 PC: 1d514 | Get extended country info
2018-12-17T22:44:59.390793053Z 99 PC: 1d51a | Get DBCS lead byte table pointer
2018-12-17T22:44:59.391873997Z 74 PC: 1d57c | Reallocate memory
2018-12-17T22:44:59.393295415Z 25 PC: 1d5b3 | Get default drive
2018-12-17T22:44:59.395306667Z 37 PC: 1d073 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-17T22:44:59.396693052Z 37 PC: 1d07a | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:44:59.398099827Z 37 PC: 1d081 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:44:59.402672918Z 74 PC: 1c21c | Reallocate memory
2018-12-17T22:44:59.404124636Z 72 PC: 1c25d | Allocate memory
2018-12-17T22:44:59.406571709Z 72 PC: 1c295 | Allocate memory
2018-12-17T22:44:59.420026209Z 72 PC: 1c29d | Allocate memory