Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 15, 2021, 10:16 a.m.	June 15, 2021, 10:21 a.m.

Size	5.4MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`c4d8200a28032eea56da319a55cb468e`
SHA256	`b6dbe343899fbfd10fa3e0cbb5537a6108751e4286065f00298d6515004124e9`
CRC32	`4117FF68`
ssdeep	`49152:l95orvWuR8l5t3feg0hQKXVQRVaBo3px3BS8j2VxNKOP:75odWbtPIPXVQ6Bl`
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)

Reynard_Hydra_pg.exe "C:\Users\test22\AppData\Local\Temp\Reynard_Hydra_pg.exe"
5292

Name	Response	Post-Analysis Lookup
checkip.dyndns.org	A 131.186.161.70 A 216.146.43.70 A 216.146.43.71 CNAME checkip.dyndns.com A 162.88.193.70 A 131.186.113.70	131.186.113.70
ip-api.com	A 208.95.112.1	208.95.112.1

IP Address	Status	Action
162.88.193.70	Active	Moloch
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
208.95.112.1	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.102:61459 -> 164.124.101.2:53	2012758	ET INFO DYNAMIC_DNS Query to *.dyndns. Domain	Misc activity
TCP 192.168.56.102:49808 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.102:49809 -> 162.88.193.70:80	2021378	ET POLICY External IP Lookup - checkip.dyndns.org	Device Retrieving External IP Address Detected
TCP 162.88.193.70:80 -> 192.168.56.102:49809	2014932	ET POLICY DynDNS CheckIp External IP Address Server Response	Device Retrieving External IP Address Detected
TCP 192.168.56.102:49808 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 15, 2021, 10:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 15, 2021, 10:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 15, 2021, 10:17 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 15, 2021, 10:17 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 15, 2021, 10:16 a.m.			0	0
IsDebuggerPresent June 15, 2021, 10:16 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 15, 2021, 10:16 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header				suspicious_request	GET http://ip-api.com/xml
suspicious_features	GET method with no useragent header				suspicious_request	GET http://checkip.dyndns.org/

Connects to a Dynamic DNS Domain (1 event)

domain

checkip.dyndns.org

Performs some HTTP requests (2 events)

request	GET http://ip-api.com/xml
request	GET http://checkip.dyndns.org/

Allocates read-write-execute memory (usually to unpack itself) (50 out of 68 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 2490368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000800000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000009e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2371000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2a0b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 2555904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002820000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002a10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2374000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2374000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2374000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2374000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ca6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bdc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ed0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bcb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92beb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bda000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ed1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ed2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ed3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bc2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92f10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c1d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bdb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92f11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92f20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92f21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:16 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92f22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:17 a.m.	process_identifier: 5292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92f23000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Looks up the external IP address (2 events)

domain	checkip.dyndns.org
domain	ip-api.com

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses June 15, 2021, 10:16 a.m.	flags: 15 family: 0		111	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 42 AntiVirus engines on VirusTotal as malicious (42 events)

MicroWorld-eScan	Trojan.GenericKD.37072388
FireEye	Trojan.GenericKD.37072388
CAT-QuickHeal	Trojan.MSIL
ALYac	Trojan.GenericKD.37072388
Cylance	Unsafe
Sangfor	Trojan.MSIL.Scar.gen
K7AntiVirus	Trojan ( 0057d90c1 )
Alibaba	Trojan:MSIL/Generic.ce9f1067
K7GW	Trojan ( 0057d90c1 )
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Agent.UOL
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Trojan.MSIL.Scar.gen
BitDefender	Trojan.GenericKD.37072388
NANO-Antivirus	Trojan.Win32.Scar.iwcydu
Paloalto	generic.ml
ViRobot	Trojan.Win32.Z.Bulz.5637632
Tencent	Msil.Trojan.Scar.Szvc
Ad-Aware	Trojan.GenericKD.37072388
Sophos	Mal/Generic-S
DrWeb	Trojan.DownLoader39.41461
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Trojan.GenericKD.37072388 (B)
Avira	TR/Agent.oywwz
MAX	malware (ai score=86)
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Trojan.Win32.Agent.vb
Microsoft	Trojan:MSIL/AgentTesla!MSR
AegisLab	Trojan.MSIL.Scar.4!c
GData	Trojan.GenericKD.37072388
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win.Agent.C4518304
McAfee	Artemis!C4D8200A2803
VBA32	TScope.Trojan.MSIL
Malwarebytes	Malware.AI.4149770651
Ikarus	Trojan.MSIL.Agent
MaxSecure	Trojan.Malware.73692470.susgen
Fortinet	W32/Scar.UOL!tr
AVG	Win32:Trojan-gen
Panda	Trj/GdSda.A

Reynard_Hydra_pg.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All