Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 12, 2021, 12:41 p.m.	June 12, 2021, 1 p.m.

Size	90.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`768c83fe9d356c8da442fbe5f074346c`
SHA256	`e73eb2a521cdfef48d95c849c7308b9579da7d840d30693763894dfa2393de8c`
CRC32	`E35CA56A`
ssdeep	`1536:xHTfRCAsi13sTDfysEqKmIJezkINa/CXtXI4p1Sik0SHKeuOFidp:xoCs6hqKxJezkIIUVNAM`
Yara	Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

saawwrr.exe "C:\Users\test22\AppData\Local\Temp\saawwrr.exe"
3972
- gomez.exe "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gomez.exe"
  1888

Name	Response	Post-Analysis Lookup
firefoxsystem.sytes.net	A 0.0.0.0	0.0.0.0
bozok.ddns.net

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.102:61459 -> 164.124.101.2:53	2028675	ET POLICY DNS Query to DynDNS Domain *.ddns .net	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 12, 2021, 12:34 p.m.			0	0
IsDebuggerPresent June 12, 2021, 12:34 p.m.			0	0
IsDebuggerPresent June 12, 2021, 12:35 p.m.			0	0
IsDebuggerPresent June 12, 2021, 12:35 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey June 12, 2021, 12:34 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000305c30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 12, 2021, 12:34 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000305ca0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 12, 2021, 12:34 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000305ca0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 12, 2021, 12:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004a6420 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 12, 2021, 12:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004a6490 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 12, 2021, 12:35 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000004a6490 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 12, 2021, 12:34 p.m.		1	1	0

Connects to a Dynamic DNS Domain (2 events)

domain	bozok.ddns.net
domain	firefoxsystem.sytes.net

Allocates read-write-execute memory (usually to unpack itself) (50 out of 97 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000008b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000009d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2361000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef29fb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000710000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000740000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2364000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2364000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2364000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2364000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c6c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c96000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bcc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ce0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bdb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ce1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bbb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ce2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c0c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bdd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bb2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c0d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c97000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ce3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ce4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bbc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:34 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bcb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 12, 2021, 12:35 p.m.	process_identifier: 1888 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000700000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 12, 2021, 12:34 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW June 12, 2021, 12:35 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 47 AntiVirus engines on VirusTotal as malicious (47 events)

Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen13.19206
MicroWorld-eScan	Gen:Variant.Razy.605160
FireEye	Generic.mg.768c83fe9d356c8d
ALYac	Gen:Variant.Razy.605160
Cylance	Unsafe
Zillya	Trojan.GenKryptik.Win32.33751
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 00556c111 )
Alibaba	Trojan:MSIL/GenKryptik.e618bdf2
K7GW	Trojan ( 00556c111 )
Cybereason	malicious.e9d356
Arcabit	Trojan.Razy.D93BE8
BitDefenderTheta	Gen:NN.ZemsilF.34738.fm0@ayJHw5i
Symantec	Trojan Horse
ESET-NOD32	a variant of MSIL/GenKryptik.DRHR
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	HEUR:Trojan.MSIL.Revenge.gen
BitDefender	Gen:Variant.Razy.605160
NANO-Antivirus	Trojan.Win32.Revenge.fyctxa
Paloalto	generic.ml
Tencent	Msil.Trojan.Revenge.Ahyq
Ad-Aware	Gen:Variant.Razy.605160
Emsisoft	Gen:Variant.Razy.605160 (B)
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Backdoor.MSIL.BLADABINDI.QDX
McAfee-GW-Edition	Artemis!Trojan
Ikarus	Trojan.MSIL.Krypt
Avira	TR/AD.AtomicRat.atd
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Trojan.Win32.Kryptik.vb
Microsoft	Trojan:Win32/Occamy.CE7
AegisLab	Trojan.MSIL.Revenge.4!c
ZoneAlarm	HEUR:Trojan.MSIL.Revenge.gen
GData	Gen:Variant.Razy.605160
Cynet	Malicious (score: 99)
AhnLab-V3	Malware/Win32.RL_Generic.C3451915
McAfee	Artemis!768C83FE9D35
TrendMicro-HouseCall	Backdoor.MSIL.BLADABINDI.QDX
Yandex	Trojan.Revenge!3t+tl423eIM
SentinelOne	Static AI - Suspicious PE
MaxSecure	Trojan.Malware.73712106.susgen
Fortinet	MSIL/GenKryptik.DOFX!tr
AVG	Win32:Malware-gen
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)

saawwrr.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All