Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 29, 2021, 2:21 p.m.	June 29, 2021, 2:23 p.m.

Size	874.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`5aad89d35ec7e782a1efc68441f98bcc`
SHA256	`35617cfc3e8cf02b91d59209fc1cd07c9c1bc4d639309d9ab0198cd60af05d29`
CRC32	`EE3D0EB9`
ssdeep	`12288:KFvcJUQSmggggghKCTCwC4CMxKcyS9CrCikxK3wip0Pe8diZkUk:KWUnmggggghKilZjyS9e1dp0PriZ8`
PDB Path	C:\Users\sinful\Downloads\SP\Bots-KLs-SRCs\SimpleRAT-master-kl\KL\GL\Stub - Copy\Client\obj\Debug\Stub.pdb
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Admin_Tool_IN_Zero - Admin Tool Sysinternals PE_Header_Zero - PE File Signature

estudiante.exe "C:\Users\test22\AppData\Local\Temp\estudiante.exe"
4244

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 29, 2021, 2:14 p.m.			0	0
IsDebuggerPresent June 29, 2021, 2:14 p.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

C:\Users\sinful\Downloads\SP\Bots-KLs-SRCs\SimpleRAT-master-kl\KL\GL\Stub - Copy\Client\obj\Debug\Stub.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 29, 2021, 2:14 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 79 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000700000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000007b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2a5b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 2490368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002370000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002550000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23c4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cfc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d26000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c5a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c6b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c9c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c6d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c42000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92db0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92db1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c5d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c5e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92dd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c5f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92db2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92de0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 29, 2021, 2:14 p.m.	process_identifier: 4244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d72000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000d3e00', u'virtual_address': u'0x00002000', u'entropy': 7.663190801649949, u'name': u'.text', u'virtual_size': u'0x000d3c34'}

entropy

7.66319080165

description

A section with a high entropy has been found

entropy

0.969679633867

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.37082330
FireEye	Generic.mg.5aad89d35ec7e782
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
ALYac	Trojan.GenericKD.37082330
Cylance	Unsafe
Zillya	Trojan.Agent.Win32.2164898
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 004cdf551 )
Alibaba	Backdoor:MSIL/SpyGate.993b6180
K7GW	Trojan ( 004cdf551 )
Cybereason	malicious.35ec7e
Cyren	W32/Trojan.ICZZ-8883
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Agent.ADE
APEX	Malicious
Avast	Win32:RATX-gen [Trj]
ClamAV	Win.Packed.Zusy-7753321-0
Kaspersky	HEUR:Backdoor.MSIL.SpyGate.gen
BitDefender	Trojan.GenericKD.37082330
NANO-Antivirus	Trojan.Win32.SpyGate.iwkbaa
Tencent	Msil.Backdoor.Spygate.Syin
Ad-Aware	Trojan.GenericKD.37082330
Sophos	Mal/Generic-R + Mal/SpyGate-A
DrWeb	BackDoor.RatNET.2
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0RF321
McAfee-GW-Edition	RDN/Generic PWS.y
Emsisoft	Trojan.GenericKD.37082330 (B)
SentinelOne	Static AI - Malicious PE
Jiangmin	Backdoor.MSIL.ertx
Avira	HEUR/AGEN.1120217
Antiy-AVL	Trojan/Generic.ASMalwS.3356D2C
Microsoft	Backdoor:Win32/Bladabindi!ml
Gridinsoft	Ransom.Win32.Obfuscator.vl!n
Arcabit	Trojan.Generic.D235D4DA
AegisLab	Trojan.MSIL.SpyGate.m!c
ZoneAlarm	HEUR:Backdoor.MSIL.SpyGate.gen
GData	Trojan.GenericKD.37082330
Cynet	Malicious (score: 99)
AhnLab-V3	Malware/Win.SpyGate.C4512377
McAfee	RDN/Generic PWS.y
MAX	malware (ai score=83)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Trojan.Agent.Gen
TrendMicro-HouseCall	TROJ_GEN.R002C0RF321
Yandex	Trojan.Agent!raUKwFmNCow
Ikarus	Trojan.MSIL.Janeleiro
Fortinet	MSIL/Agent.ADE!tr
BitDefenderTheta	Gen:NN.ZemsilF.34758.2m0@aCFmUPf

estudiante.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All