Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | June 12, 2021, 1:03 p.m. | June 12, 2021, 1:10 p.m. |
-
dgeApp17.exe C:\Users\test22\AppData\Local\Temp\dgeApp17.exe
2420
Suricata Alerts
Suricata TLS
No Suricata TLS
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox |
suspicious_features | POST method with no referer header, HTTP version 1.0 used, Connection to IP address | suspicious_request | POST http://209.141.34.39/cap-01/pin.php |
request | POST http://209.141.34.39/cap-01/pin.php |
request | POST http://209.141.34.39/cap-01/pin.php |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Login Data |
file | C:\Users\test22\AppData\Local\Chromium\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data |
file | C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Default\Login Data |
file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data |
file | C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Login Data |
file | C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox |
section | {u'size_of_data': u'0x00067800', u'virtual_address': u'0x00002000', u'entropy': 7.98912034795837, u'name': u'.text', u'virtual_size': u'0x00067634'} | entropy | 7.98912034796 | description | A section with a high entropy has been found | |||||||||
entropy | 0.957225433526 | description | Overall entropy of this PE file is high |
url | http://www.ibsensoftware.com/ |
description | Communications use DNS | rule | Network_DNS | ||||||
description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
description | Win32 PWS Loki | rule | Win32_PWS_Loki_Zero | ||||||
description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
description | (no description) | rule | DebuggerHiding__Thread | ||||||
description | (no description) | rule | DebuggerHiding__Active | ||||||
description | (no description) | rule | ThreadControl__Context | ||||||
description | (no description) | rule | SEH__vectored | ||||||
description | Checks if being debugged | rule | anti_dbg | ||||||
description | Bypass DEP | rule | disable_dep |
host | 209.141.34.39 |
file | C:\Program Files (x86)\FTPGetter\Profile\servers.xml |
file | C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml |
file | C:\Users\test22\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat |
file | C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini |
file | C:\Users\test22\AppData\Roaming\wcx_ftp.ini |
file | C:\Windows\wcx_ftp.ini |
file | C:\Users\test22\wcx_ftp.ini |
file | C:\Windows\32BitFtp.ini |
file | C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml |
file | C:\Program Files (x86)\FileZilla\Filezilla.xml |
file | C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml |
file | C:\Users\test22\AppData\Roaming\FileZilla\filezilla.xml |
registry | HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts |
registry | HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts |
registry | HKEY_CURRENT_USER\Software\Ghisler\Total Commander |
registry | HKEY_CURRENT_USER\Software\VanDyke\SecureFX |
registry | HKEY_CURRENT_USER\Software\LinasFTP\Site Manager |
registry | HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings |
registry | HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions |
registry | HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions |
registry | HKEY_CURRENT_USER\Software\Martin Prikryl |
registry | HKEY_LOCAL_MACHINE\Software\Martin Prikryl |
file | C:\Users\test22\AppData\Roaming\.purple\accounts.xml |
registry | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird |
registry | HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook |
MicroWorld-eScan | Trojan.GenericKD.37078319 |
FireEye | Generic.mg.81f63c8e0fab4d42 |
McAfee | RDN/Generic BackDoor |
Cylance | Unsafe |
Sangfor | Backdoor.MSIL.Androm.gen |
K7AntiVirus | Trojan ( 0057ddc11 ) |
BitDefender | Trojan.GenericKD.37078319 |
K7GW | Trojan ( 0057ddc11 ) |
Cybereason | malicious.b57e01 |
Arcabit | Trojan.Generic.D235C52F |
Cyren | W32/MSIL_Agent.BCR.gen!Eldorado |
Symantec | ML.Attribute.HighConfidence |
ESET-NOD32 | a variant of MSIL/Kryptik.ABKG |
APEX | Malicious |
Avast | Win32:TrojanX-gen [Trj] |
Kaspersky | HEUR:Backdoor.MSIL.Androm.gen |
Alibaba | Trojan:MSIL/Kryptik.7fb5bda7 |
AegisLab | Trojan.MSIL.Androm.m!c |
Ad-Aware | Trojan.GenericKD.37078319 |
Comodo | TrojWare.Win32.Agent.duygu@0 |
DrWeb | Trojan.PackedNET.835 |
VIPRE | Trojan.Win32.Generic!BT |
TrendMicro | TROJ_FRS.0NA103FB21 |
McAfee-GW-Edition | Artemis!Trojan |
Emsisoft | Trojan.Crypt (A) |
Webroot | W32.Trojan.Gen |
Avira | TR/Kryptik.kojhw |
Kingsoft | Win32.Hack.Undef.(kcloud) |
Gridinsoft | Trojan.Win32.Kryptik.oa |
Microsoft | Trojan:MSIL/Tnega.SS!MTB |
GData | Trojan.GenericKD.37078319 |
Cynet | Malicious (score: 100) |
AhnLab-V3 | Infostealer/Win.Agent.R425155 |
BitDefenderTheta | Gen:NN.ZemsilF.34738.Bm2@aupdZt |
MAX | malware (ai score=100) |
Malwarebytes | Trojan.MalPack.MSIL |
Zoner | Trojan.Win32.112719 |
TrendMicro-HouseCall | TROJ_FRS.0NA103FB21 |
Ikarus | Trojan.Inject |
eGambit | PE.Heur.InvalidSig |
Fortinet | MSIL/Kryptik.ABKG!tr |
AVG | Win32:TrojanX-gen [Trj] |
Paloalto | generic.ml |
CrowdStrike | win/malicious_confidence_90% (W) |
MaxSecure | Trojan.Malware.300983.susgen |