4.jpg| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6402 | Aug. 25, 2021, 10:08 a.m. | Aug. 25, 2021, 10:11 a.m. |
-
cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "SRrcSjqEZE" C:\Users\test22\AppData\Local\Temp\4.jpg
560
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
| IP Address | Status | Action |
|---|---|---|
| 165.3.80.21 | Active | Moloch |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 165.3.80.21:80 -> 192.168.56.102:49177 | 2400018 | ET DROP Spamhaus DROP Listed Traffic Inbound group 19 | Misc Attack |
Suricata TLS
No Suricata TLS
| host | 165.3.80.21 | |||
| MicroWorld-eScan | Trojan.PWS.Agent.SVN |
| FireEye | Trojan.PWS.Agent.SVN |
| ESET-NOD32 | PowerShell/TrojanDownloader.Agent.EHC |
| Kaspersky | HEUR:Trojan.PowerShell.Generic |
| BitDefender | Trojan.PWS.Agent.SVN |
| Ad-Aware | Trojan.PWS.Agent.SVN |
| Emsisoft | Trojan.PWS.Agent.SVN (B) |
| DrWeb | PowerShell.DownLoader.1403 |
| MAX | malware (ai score=84) |
| GData | Trojan.PWS.Agent.SVN |
| ALYac | Trojan.PWS.Agent.SVN |