heliocentrically.db| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | Aug. 4, 2021, 12:16 p.m. | Aug. 4, 2021, 12:19 p.m. |
-
-
secinit.exe "C:\Windows\System32\secinit.exe"
2772 -
secinit.exe "C:\Windows\System32\secinit.exe"
1472 -
secinit.exe "C:\Windows\System32\secinit.exe"
2952 -
secinit.exe "C:\Windows\System32\secinit.exe"
2832 -
secinit.exe "C:\Windows\System32\secinit.exe"
2232 -
secinit.exe "C:\Windows\System32\secinit.exe"
2428 -
secinit.exe "C:\Windows\System32\secinit.exe"
2620 -
secinit.exe "C:\Windows\System32\secinit.exe"
288 -
secinit.exe "C:\Windows\System32\secinit.exe"
2276 -
secinit.exe "C:\Windows\System32\secinit.exe"
2120
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
| IP Address | Status | Action |
|---|---|---|
| 164.124.101.2 | Active | Moloch |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| McAfee | Artemis!106B947AA2E8 |
| Cylance | Unsafe |
| Sangfor | Trojan.Win32.Save.a |
| Alibaba | Trojan:Win32/DropperX.7cc1d080 |
| Arcabit | Trojan.Zusy.D60761 |
| Cyren | W32/Agent.DEL.gen!Eldorado |
| ESET-NOD32 | a variant of Win32/Agent.ADBL |
| APEX | Malicious |
| Paloalto | generic.ml |
| Cynet | Malicious (score: 100) |
| BitDefender | Gen:Variant.Zusy.395105 |
| MicroWorld-eScan | Gen:Variant.Zusy.395105 |
| Avast | Win32:DropperX-gen [Drp] |
| Ad-Aware | Gen:Variant.Zusy.395105 |
| FireEye | Generic.mg.106b947aa2e8101b |
| Emsisoft | Gen:Variant.Zusy.395105 (B) |
| Jiangmin | Trojan.Generic.gzxaj |
| Webroot | W32.Trojan.Gen |
| MAX | malware (ai score=86) |
| Microsoft | Trojan:Win32/Wacatac.B!ml |
| GData | Gen:Variant.Zusy.395105 |
| ALYac | Gen:Variant.Zusy.395105 |
| TrendMicro-HouseCall | TROJ_GEN.R002H0CH321 |
| Fortinet | W32/Agent.ADBL!tr |
| BitDefenderTheta | Gen:NN.ZexaF.34058.jtW@au@OqQk |
| AVG | Win32:DropperX-gen [Drp] |