Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | June 25, 2021, 10 a.m. | June 25, 2021, 10:23 a.m. |
-
-
linkutq.exe "C:\Users\test22\AppData\Local\Temp\linkutq.exe"
2384
-
Name | Response | Post-Analysis Lookup |
---|---|---|
mxrz.xyz | 104.21.43.205 |
Suricata Alerts
Suricata TLS
No Suricata TLS
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox |
section | .ndata |
suspicious_features | POST method with no referer header, HTTP version 1.0 used | suspicious_request | POST http://mxrz.xyz/tker3/w2/fre.php |
request | POST http://mxrz.xyz/tker3/w2/fre.php |
request | POST http://mxrz.xyz/tker3/w2/fre.php |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Login Data |
file | C:\Users\test22\AppData\Local\Chromium\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data |
file | C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Default\Login Data |
file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data |
file | C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Login Data |
file | C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox |
file | C:\Users\test22\AppData\Local\Temp\nsk626D.tmp\System.dll |
file | C:\Users\test22\AppData\Local\Temp\nsk626D.tmp\System.dll |
file | C:\Program Files (x86)\FTPGetter\Profile\servers.xml |
file | C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml |
file | C:\Users\test22\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat |
file | C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini |
file | C:\Users\test22\AppData\Roaming\wcx_ftp.ini |
file | C:\Windows\wcx_ftp.ini |
file | C:\Users\test22\wcx_ftp.ini |
file | C:\Windows\32BitFtp.ini |
file | C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml |
file | C:\Program Files (x86)\FileZilla\Filezilla.xml |
file | C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml |
file | C:\Users\test22\AppData\Roaming\FileZilla\filezilla.xml |
registry | HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts |
registry | HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts |
registry | HKEY_CURRENT_USER\Software\Ghisler\Total Commander |
registry | HKEY_CURRENT_USER\Software\VanDyke\SecureFX |
registry | HKEY_CURRENT_USER\Software\LinasFTP\Site Manager |
registry | HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings |
registry | HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions |
registry | HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions |
registry | HKEY_CURRENT_USER\Software\Martin Prikryl |
registry | HKEY_LOCAL_MACHINE\Software\Martin Prikryl |
file | C:\Users\test22\AppData\Roaming\.purple\accounts.xml |
registry | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird |
registry | HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook |
Bkav | W32.AIDetect.malware2 |
ClamAV | Win.Trojan.Tnega-9874034-0 |
CAT-QuickHeal | Trojan.Injects |
ALYac | Trojan.GenericKD.37119679 |
Malwarebytes | Spyware.LokiBot |
VIPRE | Trojan.Win32.Generic!BT |
AegisLab | Trojan.Win32.Injects.4!c |
Sangfor | Riskware.Win32.Agent.ky |
CrowdStrike | win/malicious_confidence_100% (W) |
BitDefender | Trojan.GenericKD.37119679 |
K7GW | Trojan ( 0057e2dc1 ) |
K7AntiVirus | Trojan ( 0057e2dc1 ) |
Cyren | W32/Ninjector.J.gen!Camelot |
ESET-NOD32 | NSIS/Injector.AMJ |
APEX | Malicious |
Paloalto | generic.ml |
Cynet | Malicious (score: 100) |
Kaspersky | HEUR:Trojan.Win32.Injects.gen |
Alibaba | Trojan:Win32/FormBook.5ed2bf06 |
MicroWorld-eScan | Trojan.GenericKD.37119679 |
Rising | Trojan.Injector/NSIS!1.D743 (CLASSIC) |
Ad-Aware | Trojan.GenericKD.37119679 |
DrWeb | Trojan.Loader.838 |
TrendMicro | TROJ_GEN.R002C0DFK21 |
McAfee-GW-Edition | RDN/Generic Dropper |
FireEye | Trojan.GenericKD.37119679 |
Webroot | W32.Trojan.Dropper |
Avira | TR/AD.LokiBot.ghjog |
MAX | malware (ai score=100) |
Kingsoft | Win32.Troj.Undef.(kcloud) |
Gridinsoft | Trojan.Win32.Downloader.sa |
Arcabit | Trojan.Generic.D23666BF |
GData | Trojan.GenericKD.37119679 |
AhnLab-V3 | Trojan/Win.Tnega.R426262 |
McAfee | RDN/Generic Dropper |
VBA32 | BScope.Trojan-Dropper.Injector |
Cylance | Unsafe |
Panda | Trj/CI.A |
TrendMicro-HouseCall | TROJ_GEN.R002C0DFK21 |
Fortinet | W32/Kryptik.J!tr |
AVG | Win32:Trojan-gen |