Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | June 12, 2021, 1:03 p.m. | June 12, 2021, 1:16 p.m. |
-
RFL_0769002.exe C:\Users\test22\AppData\Local\Temp\RFL_0769002.exe
2728
Name | Response | Post-Analysis Lookup |
---|---|---|
www.injectionhub.com |
CNAME
injectionhub.com
|
78.31.67.91 |
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
TCP 192.168.56.101:49203 -> 78.31.67.91:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
TCP 192.168.56.101:49203 -> 78.31.67.91:80 | 2031449 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
TCP 192.168.56.101:49203 -> 78.31.67.91:80 | 2031453 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
Suricata TLS
No Suricata TLS
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.injectionhub.com/gw2/?DVoxn=FXrLj6pcUvcWEgV2IhOW2aVGEJqCZ51ZmnIQwRj1cPnNt9uvyqCBucCqfGVzv5lKb12zJTnw&5j=UlPt |
request | GET http://www.injectionhub.com/gw2/?DVoxn=FXrLj6pcUvcWEgV2IhOW2aVGEJqCZ51ZmnIQwRj1cPnNt9uvyqCBucCqfGVzv5lKb12zJTnw&5j=UlPt |
section | {u'size_of_data': u'0x0007b000', u'virtual_address': u'0x00002000', u'entropy': 7.993007658617986, u'name': u'.text', u'virtual_size': u'0x0007afe4'} | entropy | 7.99300765862 | description | A section with a high entropy has been found | |||||||||
entropy | 0.963761018609 | description | Overall entropy of this PE file is high |
description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
description | (no description) | rule | DebuggerHiding__Thread | ||||||
description | (no description) | rule | DebuggerHiding__Active | ||||||
description | (no description) | rule | ThreadControl__Context | ||||||
description | (no description) | rule | SEH__vectored | ||||||
description | Bypass DEP | rule | disable_dep |
DrWeb | Trojan.PackedNET.835 |
MicroWorld-eScan | Trojan.GenericKD.37076859 |
FireEye | Generic.mg.3c88c6ef1a906bc8 |
ALYac | Trojan.GenericKD.37076859 |
Cylance | Unsafe |
Sangfor | Backdoor.MSIL.Androm.gen |
K7AntiVirus | Trojan ( 0057ddc11 ) |
Alibaba | Backdoor:MSIL/Androm.19b41886 |
K7GW | Trojan ( 0057ddc11 ) |
Cybereason | malicious.9d9c20 |
BitDefenderTheta | Gen:NN.ZemsilF.34738.Gm2@aGtSzMo |
Cyren | W32/MSIL_Agent.BCR.gen!Eldorado |
Symantec | Trojan Horse |
ESET-NOD32 | a variant of MSIL/Kryptik.ABKG |
APEX | Malicious |
Avast | Win32:TrojanX-gen [Trj] |
Kaspersky | HEUR:Backdoor.MSIL.Androm.gen |
BitDefender | Trojan.GenericKD.37076859 |
Paloalto | generic.ml |
Ad-Aware | Trojan.GenericKD.37076859 |
Emsisoft | Trojan.Crypt (A) |
Comodo | TrojWare.Win32.Agent.zmbec@0 |
VIPRE | Trojan.Win32.Generic!BT |
TrendMicro | TROJ_GEN.R002C0PFA21 |
McAfee-GW-Edition | GenericRXOG-DJ!3C88C6EF1A90 |
Sophos | Mal/Generic-S |
eGambit | PE.Heur.InvalidSig |
Avira | TR/AD.Swotter.pndre |
Gridinsoft | Trojan.Win32.Kryptik.oa |
Microsoft | Trojan:Win32/AgentTesla!ml |
GData | Trojan.GenericKD.37076859 |
Cynet | Malicious (score: 100) |
McAfee | GenericRXOG-DJ!3C88C6EF1A90 |
MAX | malware (ai score=100) |
Malwarebytes | MachineLearning/Anomalous.100% |
TrendMicro-HouseCall | TROJ_GEN.R002C0PFA21 |
Ikarus | Win32.Outbreak |
MaxSecure | Trojan.Malware.300983.susgen |
Fortinet | MSIL/Kryptik.ABKG!tr |
Webroot | W32.Trojan.Gen |
AVG | Win32:TrojanX-gen [Trj] |
CrowdStrike | win/malicious_confidence_90% (W) |