Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6402 | July 14, 2021, 8:55 a.m. | July 14, 2021, 9:12 a.m. |
Name | Response | Post-Analysis Lookup |
---|---|---|
adminserver.xyz | 172.67.151.89 |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox |
section | .ndata |
suspicious_features | POST method with no referer header, HTTP version 1.0 used | suspicious_request | POST http://adminserver.xyz/Bn4/fre.php |
request | POST http://adminserver.xyz/Bn4/fre.php |
request | POST http://adminserver.xyz/Bn4/fre.php |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Login Data |
file | C:\Users\test22\AppData\Local\Chromium\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data |
file | C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Default\Login Data |
file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data |
file | C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Login Data |
file | C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox |
file | C:\Users\test22\AppData\Local\Temp\mfmtejfisx.dll |
file | C:\Users\test22\AppData\Local\Temp\mfmtejfisx.dll |
url | http://www.ibsensoftware.com/ |
description | Communications use DNS | rule | Network_DNS | ||||||
description | Win32 PWS Loki | rule | Win32_PWS_Loki_Zero | ||||||
description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
description | (no description) | rule | DebuggerHiding__Thread | ||||||
description | (no description) | rule | DebuggerHiding__Active | ||||||
description | (no description) | rule | ThreadControl__Context | ||||||
description | (no description) | rule | SEH__vectored | ||||||
description | Checks if being debugged | rule | anti_dbg | ||||||
description | Bypass DEP | rule | disable_dep |
file | C:\Program Files (x86)\FTPGetter\Profile\servers.xml |
file | C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml |
file | C:\Users\test22\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat |
file | C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini |
file | C:\Users\test22\AppData\Roaming\wcx_ftp.ini |
file | C:\Windows\wcx_ftp.ini |
file | C:\Users\test22\wcx_ftp.ini |
file | C:\Windows\32BitFtp.ini |
file | C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml |
file | C:\Program Files (x86)\FileZilla\Filezilla.xml |
file | C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml |
file | C:\Users\test22\AppData\Roaming\FileZilla\filezilla.xml |
registry | HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts |
registry | HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts |
registry | HKEY_CURRENT_USER\Software\Ghisler\Total Commander |
registry | HKEY_CURRENT_USER\Software\VanDyke\SecureFX |
registry | HKEY_CURRENT_USER\Software\LinasFTP\Site Manager |
registry | HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings |
registry | HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions |
registry | HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions |
registry | HKEY_CURRENT_USER\Software\Martin Prikryl |
registry | HKEY_LOCAL_MACHINE\Software\Martin Prikryl |
file | C:\Users\test22\AppData\Roaming\.purple\accounts.xml |
file | C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini |
registry | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird\78.4.0 (ko)\Main |
registry | HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook |
Bkav | W32.AIDetect.malware1 |
Elastic | malicious (high confidence) |
DrWeb | Trojan.Siggen14.36342 |
MicroWorld-eScan | Trojan.Nsis.Spy.Gen.2 |
FireEye | Generic.mg.d2e7122631ac9f75 |
Cylance | Unsafe |
Sangfor | Riskware.Win32.Agent.ky |
CrowdStrike | win/malicious_confidence_90% (W) |
K7GW | Riskware ( 0040eff71 ) |
ESET-NOD32 | a variant of Win32/Injector.EPSY |
APEX | Malicious |
Paloalto | generic.ml |
Kaspersky | UDS:DangerousObject.Multi.Generic |
BitDefender | Trojan.Nsis.Spy.Gen.2 |
Avast | FileRepMalware |
Sophos | ML/PE-A |
VIPRE | Trojan.Win32.Generic!BT |
McAfee-GW-Edition | BehavesLike.Win32.Vopak.cc |
Emsisoft | Trojan.Nsis.Spy.Gen.2 (B) |
MAX | malware (ai score=89) |
Microsoft | Trojan:Win32/Bomitag.D!ml |
ZoneAlarm | UDS:DangerousObject.Multi.Generic |
GData | Zum.Androm.1 |
Cynet | Malicious (score: 100) |
McAfee | RDN/Generic.cf |
Yandex | Trojan.Slntscn24.bVVB1s |
SentinelOne | Static AI - Malicious PE |
Fortinet | W32/Injector.EOWC!tr |
AVG | FileRepMalware |
Cybereason | malicious.631ac9 |
Panda | Trj/RnkBend.A |
Qihoo-360 | HEUR/QVM20.1.8EBA.Malware.Gen |