Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | June 12, 2021, 11:22 a.m. | June 12, 2021, 11:24 a.m. |
-
RFL_0769002.exe C:\Users\test22\AppData\Local\Temp\RFL_0769002.exe
1348
Name | Response | Post-Analysis Lookup |
---|---|---|
www.quangcaosonthach.com |
CNAME
quangcaosonthach.com
|
103.237.145.7 |
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
TCP 192.168.56.101:49205 -> 103.237.145.7:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
TCP 192.168.56.101:49205 -> 103.237.145.7:80 | 2031449 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
TCP 192.168.56.101:49205 -> 103.237.145.7:80 | 2031453 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
Suricata TLS
No Suricata TLS
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.quangcaosonthach.com/gw2/?DVldV=nK+cpShbKNzMzU5qLnlc+tBFBddRBf6O1ztjvSAMnluiyaRb30M36lbYqq0lmPBz7QeF2Hp1&mnSl=Txlh |
request | GET http://www.quangcaosonthach.com/gw2/?DVldV=nK+cpShbKNzMzU5qLnlc+tBFBddRBf6O1ztjvSAMnluiyaRb30M36lbYqq0lmPBz7QeF2Hp1&mnSl=Txlh |
section | {u'size_of_data': u'0x0007b000', u'virtual_address': u'0x00002000', u'entropy': 7.993007658617986, u'name': u'.text', u'virtual_size': u'0x0007afe4'} | entropy | 7.99300765862 | description | A section with a high entropy has been found | |||||||||
entropy | 0.963761018609 | description | Overall entropy of this PE file is high |
description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
description | (no description) | rule | DebuggerHiding__Thread | ||||||
description | (no description) | rule | DebuggerHiding__Active | ||||||
description | (no description) | rule | ThreadControl__Context | ||||||
description | (no description) | rule | SEH__vectored | ||||||
description | Bypass DEP | rule | disable_dep |
MicroWorld-eScan | Trojan.GenericKD.37076859 |
FireEye | Generic.mg.3c88c6ef1a906bc8 |
ALYac | Trojan.GenericKD.37076859 |
Cylance | Unsafe |
Sangfor | Backdoor.MSIL.Androm.gen |
K7AntiVirus | Trojan ( 0057ddc11 ) |
Alibaba | Trojan:MSIL/Kryptik.a182b2bf |
K7GW | Trojan ( 0057ddc11 ) |
Cybereason | malicious.9d9c20 |
Arcabit | Trojan.Generic.D235BF7B |
BitDefenderTheta | Gen:NN.ZemsilF.34738.Gm2@aGtSzMo |
Cyren | W32/MSIL_Agent.BCR.gen!Eldorado |
Symantec | ML.Attribute.HighConfidence |
ESET-NOD32 | a variant of MSIL/Kryptik.ABKG |
APEX | Malicious |
Avast | Win32:TrojanX-gen [Trj] |
Kaspersky | HEUR:Backdoor.MSIL.Androm.gen |
BitDefender | Trojan.GenericKD.37076859 |
Paloalto | generic.ml |
AegisLab | Trojan.Win32.Generic.4!c |
Ad-Aware | Trojan.GenericKD.37076859 |
Sophos | Mal/Generic-S |
VIPRE | Trojan.Win32.Generic!BT |
TrendMicro | TROJ_GEN.R002C0PFA21 |
McAfee-GW-Edition | GenericRXOG-DJ!3C88C6EF1A90 |
Emsisoft | Trojan.GenericKD.37076859 (B) |
Ikarus | Win32.Outbreak |
eGambit | PE.Heur.InvalidSig |
Avira | TR/AD.Swotter.pndre |
Gridinsoft | Trojan.Win32.Kryptik.oa |
Microsoft | Trojan:Win32/AgentTesla!ml |
GData | Trojan.GenericKD.37076859 |
Cynet | Malicious (score: 100) |
McAfee | GenericRXOG-DJ!3C88C6EF1A90 |
MAX | malware (ai score=100) |
Malwarebytes | Trojan.MalPack.MSIL |
TrendMicro-HouseCall | TROJ_GEN.R002C0PFA21 |
MaxSecure | Trojan.Malware.300983.susgen |
Fortinet | MSIL/Kryptik.ABKG!tr |
Webroot | W32.Trojan.Gen |
AVG | Win32:TrojanX-gen [Trj] |
CrowdStrike | win/malicious_confidence_90% (W) |