updatewin1.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6402 | May 20, 2021, 9:33 a.m. | May 20, 2021, 9:42 a.m. |
-
updatewin1.exe "C:\Users\test22\AppData\Local\Temp\updatewin1.exe"
2952
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
| IP Address | Status | Action |
|---|---|---|
| 172.217.25.14 | Active | Moloch |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
| resource name | NUTAVECEHENUBEPUHUGUWUJEJIXA |
| resource name | SOJEVILOHAMOCUGOROZOTAHUJAMIJU |
| resource name | WADUTO |
| name | NUTAVECEHENUBEPUHUGUWUJEJIXA | language | LANG_SERBIAN | filetype | ASCII text, with no line terminators | sublanguage | SUBLANG_DEFAULT | offset | 0x00049c78 | size | 0x00000100 | ||||||||||||||||||
| name | SOJEVILOHAMOCUGOROZOTAHUJAMIJU | language | LANG_SERBIAN | filetype | ASCII text, with very long lines, with no line terminators | sublanguage | SUBLANG_DEFAULT | offset | 0x00049d78 | size | 0x000002d4 | ||||||||||||||||||
| name | WADUTO | language | LANG_SERBIAN | filetype | ASCII text, with no line terminators | sublanguage | SUBLANG_DEFAULT | offset | 0x00049c08 | size | 0x00000070 | ||||||||||||||||||
| name | RT_BITMAP | language | LANG_SERBIAN | filetype | data | sublanguage | SUBLANG_DEFAULT | offset | 0x00044248 | size | 0x00002c08 | ||||||||||||||||||
| name | RT_BITMAP | language | LANG_SERBIAN | filetype | data | sublanguage | SUBLANG_DEFAULT | offset | 0x00044248 | size | 0x00002c08 | ||||||||||||||||||
| name | RT_BITMAP | language | LANG_SERBIAN | filetype | data | sublanguage | SUBLANG_DEFAULT | offset | 0x00044248 | size | 0x00002c08 | ||||||||||||||||||
| name | RT_ICON | language | LANG_SERBIAN | filetype | dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 351727351, next used block 0 | sublanguage | SUBLANG_DEFAULT | offset | 0x00043138 | size | 0x000010a8 | ||||||||||||||||||
| name | RT_DIALOG | language | LANG_SERBIAN | filetype | data | sublanguage | SUBLANG_DEFAULT | offset | 0x000441f8 | size | 0x0000004c | ||||||||||||||||||
| name | RT_STRING | language | LANG_SERBIAN | filetype | data | sublanguage | SUBLANG_DEFAULT | offset | 0x0004a208 | size | 0x0000036a | ||||||||||||||||||
| name | RT_GROUP_ICON | language | LANG_SERBIAN | filetype | data | sublanguage | SUBLANG_DEFAULT | offset | 0x000441e0 | size | 0x00000014 | ||||||||||||||||||
| name | RT_VERSION | language | LANG_SERBIAN | filetype | data | sublanguage | SUBLANG_DEFAULT | offset | 0x0004a050 | size | 0x000001b4 | ||||||||||||||||||
| section | {u'size_of_data': u'0x0000a600', u'virtual_address': u'0x00040000', u'entropy': 6.875800779824197, u'name': u'.rsrc', u'virtual_size': u'0x0000a578'} | entropy | 6.87580077982 | description | A section with a high entropy has been found | |||||||||
| host | 172.217.25.14 | |||
| Bkav | W32.TiggreRP.Trojan |
| MicroWorld-eScan | Trojan.GenericKD.31534187 |
| CAT-QuickHeal | Ransom.Stop.S7866402 |
| Cylance | Unsafe |
| Zillya | Trojan.Vilsel.Win32.37830 |
| SUPERAntiSpyware | Trojan.Agent/Gen-Downloader |
| Sangfor | Trojan.Win32.Save.a |
| K7AntiVirus | Trojan ( 00545a541 ) |
| Alibaba | Trojan:Win32/Fareit.b230fdcc |
| K7GW | Trojan ( 00545a541 ) |
| Cybereason | malicious.d6240f |
| Cyren | W32/Kryptik.PT.gen!Eldorado |
| ESET-NOD32 | Win32/Agent.AAFU |
| APEX | Malicious |
| Avast | Win32:BotX-gen [Trj] |
| Cynet | Malicious (score: 100) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| NANO-Antivirus | Trojan.Win32.Stealer.fmbxlx |
| Paloalto | generic.ml |
| ViRobot | Trojan.Win32.S.GandCrab.279040 |
| Rising | Trojan.Kryptik!1.B582 (KTSE) |
| Ad-Aware | Trojan.GenericKD.31534187 |
| Sophos | Mal/Generic-R + Mal/GandCrab-G |
| Comodo | TrojWare.Win32.Ransom.GandCrypt.AA@82gsko |
| DrWeb | Trojan.PWS.Stealer.24943 |
| VIPRE | Trojan.Win32.Generic!BT |
| TrendMicro | Trojan.Win32.STOP.AC |
| Emsisoft | Trojan.Agent (A) |
| F-Prot | W32/Kryptik.PT.gen!Eldorado |
| Jiangmin | Trojan.Generic.dcbhq |
| Webroot | W32.Trojan.Gen |
| Avira | TR/Crypt.Agent.iyodi |
| MAX | malware (ai score=100) |
| Kingsoft | Win32.Troj.Undef.(kcloud) |
| Gridinsoft | Trojan.Win32.Kryptik.vb |
| AegisLab | Trojan.Win32.Generic.4!c |
| ZoneAlarm | HEUR:Trojan.Win32.Generic |
| AhnLab-V3 | Win-Trojan/Gandcrab10.Exp |
| VBA32 | BScope.Trojan.Chapak |
| TACHYON | Ransom/W32.GandCrab.279040 |
| Malwarebytes | Trojan.MalPack.GS |
| Zoner | Trojan.Win32.80450 |
| TrendMicro-HouseCall | Trojan.Win32.STOP.AC |
| Tencent | Malware.Win32.Gencirc.114db74c |
| Yandex | Trojan.GenAsa!0onnx8zfuyY |
| Ikarus | Trojan-Ransom.Downloader.Stop |
| eGambit | Unsafe.AI_Score_90% |
| Fortinet | W32/Generic.AAFU!tr |
| AVG | Win32:BotX-gen [Trj] |
| Panda | Trj/WLT.E |