Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 25, 2021, 10:10 a.m.	June 25, 2021, 10:31 a.m.

Size	939.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`498cb503233c8b3fc43788d659f50b8d`
SHA256	`3c72a2e90021f83eacd4a9b06c206b61be2fd7020dd744465c8a11c72980b52c`
CRC32	`8D42BA67`
ssdeep	`24576:rnqxcFAEkwO4YrXud4Ubvt+DZlUyK09J+E4l:rnTFAEkwOJ2bV+9lhY`
PDB Path	infinia.Client.pdb
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) Generic_Malware_Zero - Generic Malware IsPE32 - (no description)

infinia.client.exe "C:\Users\test22\AppData\Local\Temp\infinia.client.exe"
5620

Name	Response	Post-Analysis Lookup
robotpos.com	A 109.232.219.146	109.232.219.146

IP Address	Status	Action
109.232.219.146	Active	Moloch
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 25, 2021, 9:54 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:54 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (4 events)

Time & API	Arguments	Status	Return
CryptExportKey June 25, 2021, 9:54 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bdb4fd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:54 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bdb5040 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:54 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bdb5040 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 9:54 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001bdb5040 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

infinia.Client.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 25, 2021, 9:54 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET http://robotpos.com/infiniaClient/companyList.xml?a=b

Performs some HTTP requests (1 event)

request

GET http://robotpos.com/infiniaClient/companyList.xml?a=b

Allocates read-write-execute memory (usually to unpack itself) (50 out of 89 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000970000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2a5b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002210000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000022e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cfc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d26000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92db0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c5a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c6b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c5d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d74000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c42000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 53248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d75000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c9c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c6d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92de0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c9d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92df0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92de1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 25, 2021, 9:54 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92df1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses June 25, 2021, 9:54 a.m.	flags: 1158 family: 0	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000d5e00', u'virtual_address': u'0x00002000', u'entropy': 7.783769986925419, u'name': u'.text', u'virtual_size': u'0x000d5ce4'}

entropy

7.78376998693

description

A section with a high entropy has been found

entropy

0.911075612354

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 34 AntiVirus engines on VirusTotal as malicious (34 events)

MicroWorld-eScan	Trojan.GenericKD.37142584
CAT-QuickHeal	Trojan.Multi
ALYac	Trojan.GenericKD.46501872
Cylance	Unsafe
Sangfor	Riskware.Win32.Agent.ky
Alibaba	Trojan:Win32/Generic.6ef58e3b
Cyren	W32/Trojan.EQCL-7360
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.GenericKD.37142584
AegisLab	Trojan.Multi.Generic.4!c
Avast	Win32:Malware-gen
Ad-Aware	Trojan.GenericKD.37142584
Emsisoft	Trojan.GenericKD.37142584 (B)
TrendMicro	TROJ_GEN.R002C0PFM21
McAfee-GW-Edition	RDN/Generic.dx
FireEye	Trojan.GenericKD.37142584
GData	Trojan.GenericKD.37142584
Webroot	W32.Trojan.GenKD
Antiy-AVL	Trojan/Generic.ASMalwS.339A420
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Arcabit	Trojan.Generic.D2C58FF0
Microsoft	Program:Win32/Wacapew.C!ml
Cynet	Malicious (score: 100)
McAfee	RDN/Generic.dx
MAX	malware (ai score=100)
VBA32	TScope.Trojan.MSIL
Malwarebytes	MachineLearning/Anomalous.93%
TrendMicro-HouseCall	TROJ_GEN.R002C0PFM21
Fortinet	PossibleThreat
AVG	Win32:Malware-gen
Panda	Trj/GdSda.A
MaxSecure	Trojan.Malware.300983.susgen

infinia.client.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All