rfl_01098752.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6402 | June 12, 2021, 11:23 a.m. | June 12, 2021, 11:27 a.m. |
-
rfl_01098752.exe C:\Users\test22\AppData\Local\Temp\rfl_01098752.exe
6152
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| www.hsxytz.com | 154.84.115.227 |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.102:49810 -> 154.84.115.227:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.102:49810 -> 154.84.115.227:80 | 2031449 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.102:49810 -> 154.84.115.227:80 | 2031453 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
Suricata TLS
No Suricata TLS
| suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.hsxytz.com/gw2/?wPT=L1XyuERUZAN7GjmZXl9lGC0xuXxteQ1a6payECjBCuYlsCvzsyZNPLPzNw9teZKdXe1TvUf8&oXN=6lSd02cp | ||||||
| request | GET http://www.hsxytz.com/gw2/?wPT=L1XyuERUZAN7GjmZXl9lGC0xuXxteQ1a6payECjBCuYlsCvzsyZNPLPzNw9teZKdXe1TvUf8&oXN=6lSd02cp |
| section | {u'size_of_data': u'0x0007d200', u'virtual_address': u'0x00002000', u'entropy': 7.990204574161743, u'name': u'.text', u'virtual_size': u'0x0007d164'} | entropy | 7.99020457416 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.964354527938 | description | Overall entropy of this PE file is high | |||||||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| host | 172.217.25.14 | |||
| MicroWorld-eScan | Trojan.GenericKD.37074552 |
| FireEye | Generic.mg.d2a8ef4a18e3c6dc |
| McAfee | RDN/Generic.hbg |
| Cylance | Unsafe |
| Sangfor | Riskware.Win32.Agent.ky |
| K7AntiVirus | Trojan ( 0057dd721 ) |
| K7GW | Trojan ( 0057dd721 ) |
| CrowdStrike | win/malicious_confidence_90% (W) |
| Cyren | W32/MSIL_Kryptik.DZK.gen!Eldorado |
| Symantec | ML.Attribute.HighConfidence |
| ESET-NOD32 | a variant of MSIL/Kryptik.ABKG |
| APEX | Malicious |
| Avast | Win32:CrypterX-gen [Trj] |
| Kaspersky | HEUR:Trojan-Spy.MSIL.Noon.gen |
| BitDefender | Trojan.GenericKD.37074552 |
| Paloalto | generic.ml |
| Ad-Aware | Trojan.GenericKD.37074552 |
| Emsisoft | Trojan.GenericKD.37074552 (B) |
| TrendMicro | Trojan.MSIL.AGENTTESLA.USMANFA21 |
| McAfee-GW-Edition | Artemis!Trojan |
| MaxSecure | Trojan.Malware.300983.susgen |
| Sophos | Mal/Generic-S + Troj/Formbo-AJL |
| SentinelOne | Static AI - Suspicious PE |
| Avira | TR/Kryptik.kqxbi |
| MAX | malware (ai score=82) |
| Kingsoft | Win32.Troj.Undef.(kcloud) |
| Microsoft | Trojan:MSIL/AgentTesla.AM!MTB |
| AegisLab | Trojan.MSIL.Noon.l!c |
| ZoneAlarm | HEUR:Trojan-Spy.MSIL.Noon.gen |
| GData | Trojan.GenericKD.37074552 |
| Cynet | Malicious (score: 100) |
| ALYac | Trojan.GenericKD.37074552 |
| Malwarebytes | MachineLearning/Anomalous.100% |
| TrendMicro-HouseCall | Trojan.MSIL.AGENTTESLA.USMANFA21 |
| Ikarus | Win32.Outbreak |
| eGambit | PE.Heur.InvalidSig |
| Fortinet | PossibleThreat.PALLAS.H |
| AVG | Win32:CrypterX-gen [Trj] |
| Cybereason | malicious.d6e152 |