Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 7, 2021, 12:18 p.m.	Sept. 7, 2021, 12:20 p.m.

Size	712.6KB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`adfe31c40569ca5b0b403f0ba3f7b24c`
SHA256	`68d1b6dbfc303f1949267ce03ac2164ee9cda951231e72e6a5e39a44764ebbf2`
CRC32	`98F57323`
ssdeep	`12288:CcXe9SLN+NH0khUZY+vcvw1jG8QYewwB9gL1xBliJZcaFh:CcO2Q2ZYuSoel9gLHBlyZcaj`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet

3cc0e0be954dc849581f9ff1817647de.exe "C:\Users\test22\AppData\Local\Temp\3cc0e0be954dc849581f9ff1817647de.exe"
876
- 3cc0e0be954dc849581f9ff1817647de.exe "C:\Users\test22\AppData\Local\Temp\3cc0e0be954dc849581f9ff1817647de.exe" -a
  1948
rundll32.exe rUNdlL32.eXe "C:\Users\test22\AppData\Local\Temp\axhub.dll",main
2248
- rundll32.exe rUNdlL32.eXe "C:\Users\test22\AppData\Local\Temp\axhub.dll",main
  2864

Name	Response	Post-Analysis Lookup
b.upstloans.net	A 104.21.31.210 A 172.67.179.248	104.21.31.210
google.vrthcobj.com		34.97.69.225
crl.identrust.com	A 121.254.136.27 CNAME a1952.dscq.akamai.net CNAME identrust.edgesuite.net A 121.254.136.57	23.67.53.11
google.vrthcobj.com	A 34.97.69.225	34.97.69.225
a.upstloans.net	A 104.21.31.210 A 172.67.179.248	172.67.179.248
ip-api.com	A 208.95.112.1	208.95.112.1

IP Address	Status	Action
121.254.136.27	Active	Moloch
164.124.101.2	Active	Moloch
172.67.179.248	Active	Moloch
208.95.112.1	Active	Moloch
34.97.69.225	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49169 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.102:49169 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.102:49169 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.102:49169 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49172 172.67.179.248:443	C=US, O=Let's Encrypt, CN=R3	CN=*.upstloans.net	12:ed:3c:4a:ff:c2:a1:8d:83:7a:48:18:92:32:52:dc:a3:6f:83:f7
TLSv1 192.168.56.102:49170 172.67.179.248:443	C=US, O=Let's Encrypt, CN=R3	CN=*.upstloans.net	12:ed:3c:4a:ff:c2:a1:8d:83:7a:48:18:92:32:52:dc:a3:6f:83:f7
TLSv1 192.168.56.102:49174 172.67.179.248:443	C=US, O=Let's Encrypt, CN=R3	CN=*.upstloans.net	12:ed:3c:4a:ff:c2:a1:8d:83:7a:48:18:92:32:52:dc:a3:6f:83:f7
TLSv1 192.168.56.102:49173 172.67.179.248:443	None	None	None

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 7, 2021, 12:18 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 7, 2021, 12:18 p.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 7, 2021, 12:18 p.m.		1	1	0

The executable uses a known packer (1 event)

packer

Armadillo v1.71

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	POST method with no referer header				suspicious_request	POST https://a.upstloans.net/report7.4.php
suspicious_features	POST method with no referer header				suspicious_request	POST https://b.upstloans.net/report7.4.php

Performs some HTTP requests (4 events)

request	GET http://ip-api.com/json/?fields=8198
request	GET http://crl.identrust.com/DSTROOTCAX3CRL.crl
request	POST https://a.upstloans.net/report7.4.php
request	POST https://b.upstloans.net/report7.4.php

Sends data using the HTTP POST Method (2 events)

request	POST https://a.upstloans.net/report7.4.php
request	POST https://b.upstloans.net/report7.4.php

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 7, 2021, 12:18 p.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74bcc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 12:18 p.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74130000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 12:18 p.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74041000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 12:18 p.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 12:18 p.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 12:18 p.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74042000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 12:18 p.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74ba1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 12:18 p.m.	process_identifier: 2864 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f40000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 12:18 p.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fe0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 12:18 p.m.	process_identifier: 2864 region_size: 1052672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02030000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 12:18 p.m.	process_identifier: 2864 region_size: 380928 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 12:18 p.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x740e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 12:18 p.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76b61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 12:18 p.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74b81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 12:18 p.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76ba1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 12:18 p.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x765c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 12:18 p.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f71000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 12:18 p.m.	process_identifier: 2864 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02140000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Looks up the external IP address (1 event)

domain

ip-api.com

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Local\Temp\api-ms-win-core-string-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\api-ms-win-core-namedpipe-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\axhub.dll

Drops an executable to the user AppData folder (3 events)

file	C:\Users\test22\AppData\Local\Temp\api-ms-win-core-namedpipe-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\api-ms-win-core-string-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\axhub.dll

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (6 events)

Time & API	Arguments	Status	Return
Process32NextW Sept. 7, 2021, 12:18 p.m.	snapshot_handle: 0x00000120 process_name: taskhost.exe process_identifier: 2092	1	1
Process32NextW Sept. 7, 2021, 12:18 p.m.	snapshot_handle: 0x00000120 process_name: conhost.exe process_identifier: 2968	1	1
Process32NextW Sept. 7, 2021, 12:18 p.m.	snapshot_handle: 0x00000120 process_name: SearchProtocolHost.exe process_identifier: 2268	1	1
Process32NextW Sept. 7, 2021, 12:18 p.m.	snapshot_handle: 0x00000120 process_name: WmiPrvSE.exe process_identifier: 1148	1	1
Process32NextW Sept. 7, 2021, 12:18 p.m.	snapshot_handle: 0x00000120 process_name: rundll32.exe process_identifier: 2248	1	1
Process32NextW Sept. 7, 2021, 12:18 p.m.	snapshot_handle: 0x00000120 process_name: rundll32.exe process_identifier: 2864	1	1

Expresses interest in specific running processes (1 event)

process

rundll32.exe

Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExW Sept. 7, 2021, 12:18 p.m.	key_handle: 0x00000124 regkey_r: 1 reg_type: 3 (REG_BINARY) value: ÁÕx4XÁåH<PÁýPwËoÜØ_µHÅµ¾HÅ¼«HcáA@Å±4^¯fZÅÊC@K°h·?ËjètM=ãK£¹áü÷¶Ãc~¹²$ ?xÃ{aLÇs°Íh$ÏüsEø½ç@tPAÊ]ù¸003ú6)Ã{¸ÍE´H±Æ·¹ÎMÅÉ`tÃ]ÁÍ`dÁÂGÅh»ÿ^ßptÃE&÷3áù¸HÃE¾(Ã×x\|ÃçHD(ÃÿPL ËGôqÃ çÁÕx<Åh,]ÅáHñÉm,Àe-Ã!E`3èâ.DDHîçLLLHÃÛHTÇÙB]ÆÉr}ÈEÏû~I#\|·@NRÆPÉ7¼BÉÌüp:ò2z½ÃÎòÿ)øTK¸ÀL½ThÃÞêúÎRÖ±¼ÃÄº[B!ãË·=ÊhêtªÀ4³pºÊúQiJó±x`AnóÁÏXNÛÅûrEN±½J¶<ÇÓyc¤c1~"yò8zBaj ;»¾ÊÊe©3vJÃÏ¸£@ÊÂUUJËCØJÓrêÞ7µÎ&JÂsëß!¦Aø.@\|2~oNÇH<>Î±~¦$ËÍÏJKP{û´®ÉÌ@p·OÁN±¾I¶?Âû¹y`§eXXJ>==>§"ÍÅ K¸ûòÁ#ÀL¼eIOfïÕBE´kWÅÀL[ß±¿À Æ¹X@#ãÛ·>Ëiët^õ;¡Ñï§±·ÅÀ8/]÷©¿ìOÃI)é1óÃ¸ÔðHÉEÀ_ËoÄÀûí·ËkáAËGìëÁÕx,]ËoÜxÃrrQcõ;Q!ïFáü÷¶ÁÍ`À6#F²$ ?xÃc9,F;ÂÁ ¬LÇkTAFð¾õz4ÇsGRFR¹Á ¤èu`·ÁÍ`lÇckx»3t4ó)¼V¸õZf_>s~²½ f_>r+KtÅ Hsâ«§T½nEt}½<u¶{¸ fãÁz(bÃA²z(vÄHðf_}zaÑàK¸óz8JÁ¹ úBZÉÜPLÈE´VkÄÊE:øÌþ¶JÑËBéarë¬ÔúÏÇr}~ñÅß¢»Ïßjjgá¾5FÒÊI¶µoù´'zó»OqÀAÊJxrCIÊÈGENHC;áÑÂÀÖsiÌÄ¶üËCJ¶ÚáêNLÏZÊkét¾ojn_¾øù@Aù¸00AÊYáú6ÃSÍEÏ_%»ÏÏzjÃ\ÃC¾(vúN¸^"wr8u:Èäh¸rÅÁÊJÚE´VgÎJÖEÀE´aTÊZÒHÅKKÔ¾(vú¯'Bî]WR8t²ÇçHõZf_:wweïK+GèEHKøÂ>sv7°EÏ D}¶;´HÅOÇPgto»NÏÉFEBË¼ý½AÊKËkà@9¤/³UE¾EwÁÇBMJ¸¶¸¹ððAN¸w¦Eâx¹ f]ú´dKÀaðJÇOMHÊBÃOfÿ¡¹vúBÉFLKÓ[NÏÉFEBË½ÖïÇ/¬EÏHÅ¹7EÏÅBHÏå~XKÈÏ{¼Oè§Oð«pmvúÇk¨ÍEÏü¾Êb¤t7z3ÂEÎr±ÃXÂGÍW«\| ¸e9ìOËAÀJKÐ,k°¤EvúÍEÏÄ½´Â+g·:Çv´&äHÆ;{u0\|Ê÷ËEÒEµôÍÇ/¬LÇçHdÏ' EÀE´S¬#¤E´iCðâ¿«ÇOÇH+éB¾ÁÖouvóKôW`Ã@KøºÌýq])(REµhXvóóáÃ@4(äáù¸HÃ@¾+=OZtMÃ×xT8ËGôq²Ñ«XÄÂ/qÍ 666Ûqïpí â¿%äåÐ¥ð"+¤ìJ £ %ËN ÊDLZ`` @Aõöà!@p=NøôPÞÖ]81UH©¤øó$Õ/îççÿúõ´)DdÆX'çÔXÁJ@ JN¥æÁAFz@úÁ+êÁ ÉÇÀúøú:ÁÊoªÇÏÕÉ>å ì ÇÜïeÞËÕ[ÒåÓcÞÈRÀ¬iû{¶xÇKâØþ~oxiXÅ@©uÌÌHHoÄÀï3úvóóáÉô{ÀÀúëÑÀèerßÒ'aFNÁÚþ"GÌ Á·ú£Ëÿó©â5h~'=øÀÃÖbhâá,Ìà3Åö"4öà!áÃ#ãÀfï¾äÀÃ èóûCu80xÅáHhÃ # /"öÁ ÅE À2RHcË¨ÅÙp0»»b%ºê': 8DÀHÃÆMH{þ%lêaèuMYP¢àÍèÑôÙK{éxòcéîzèØØã(5pòmôgèÁùÑéhêÛ]íjîóÑ°çêÚóç7_½å6ááú6êQ/þUÔILJxµE´dPbBF&HMÄúD ³¼E@@( tÌiÈÃ'¥ì yyûzö»¯MGQELwvÁÕ\$,@ÁåH4XHýP<PÁõX,(av((hÅ 78-ôÁJ±êôuSPÕá²Þb1sKàëPÙCÅö#Áo;0`8µøwdn"+@ öØ+cKCà'G¹»2ÐáIÁÎÿP,ñ¡IÁ%!¶+ËÜüA!D'}bw@Hmït´Ãçh X4ßÿPdH÷XlÁ KÁHÓ ®!@!`ÇDÇõ âRuE5ñ¦¡ÃæbB_ÇÂ'$_ÇÏÃ×xa!Ãv¶þQÃrÄ¥v5Âuy·"¸!!hÃD'âLÚY"æGiEH<9xßþ·RöÈAI IÃKé]P 4\AÔ!ÃÂiÏêÒQö[°ÀF-!Ll Ag¬~ú~B$Vù°àó<n¡óÕÄó«z3xH0KÓI5ê¡¥!mÝ;:1º tN[ñyê<1ãø%[çïü´±ä´t¨uü-10Ãö4:8.Ä÷ð ÿ$µËyàªHÈÂO é zbòu§·éìt·YG¿ê ßÈP·êPB+=D]\±çI·ÚÞÇÏ mÞäQj¨98#®MÊ{¸ÃaZ£elñ"ÆDµs»¯gXÌÿs8ÇÈKµ!PutÃÕ/£ÃÇëÈd 31Ro=GSm0Ãß»ë¨¥+hS,µÊ$ûÃ«nÍ÷vÀkÏx£Uh)_!¾8éêÜùµEµgMß¤HHDpXÅÉ`DPt`\|Á1?/v`A;ÇDgok'Æ<GÝyL//h\|ÁßÕ¶E?w³á!°8ÅÂàâÂÄ¤Ã·êXÿ´rf³µtX ò¼À!=^u[x4@ÅÒ?gsPzüßG)_@öæWû º½uÃÌOÈI@ÃápJRTÃÛC[ÃÄ¯È&nfNLÖôó+4otÉËv°QCÄHïê¨.ºd¯ùÆÛH@¢3ÁÇT@´/ÌA¶,}líáõãás÷ç#u´âO\|³Òá §ÐzØBÛ~ôKyÔù@/$Oh(Ãð:Æ¨¿âv\pPS+ÈókH{d¢#RgêêÇò ©Ôt$6ò+º¡âz^7[ôû´îççUÍW®qr`Òò¦¬UV1OíAfË+{ßûHØ)KjÞW8ow}yZKe@Ëoé%2Ë ÙAÅÁh1C/êA´ôEÏÕ\|§»ýÃÓÐu71FâÞïD¿-ýR_À0ôïìÉó³YÊC+JHEµ¬{1Æ»?p¶ó´ùêÈRëzfß'êÏz LDÇï!AH(¥þ¿ÔG@K7@ÇWÀâsÉÀúSwÆñjÙà¥-óÂõ¸£è{¼ÇiâHÃb`>8¹-EÍzðAÈÊkkÓM/rQ¶¯À[SEÄòkUÈxtÍ+ìBGù¨±¦ô C.9VHÃÎu\|Ç@Ä·úemÎMÁD`qÂ_Å;2vô÷ñ021³0ôÕý¤7ªE52xòÑÎu`ZÁõ+ÊBÃ@#ÔìÕô4xD,Ü®Vi4EzB¨ÔL(^N¤¦¢Ú9òþ]>¸~tERqÇgB¡}ðY¨8!Tÿ[HiÀiML7àÉ-â¹êP¨¦§à OÁ1+Ãº¶æÿ$Óº`îS<$p·G%Ü¶+ºÀcä<Í´6óãÅÌe%H@ÍL½yÏÜW9ûZ8ãZF$=JIÅh,[ÕHÁ"ê¿x MÅí(¸¹A"{ü¤T´Å²ã[;(¼\l+ «{òNÐq4K¹ó5J;ìàEwß¥Ãë¡Ì$Fs DËCÂ»ðø¥sùî[2zyuq7ó+î´µDúýÉÑ3a+óCUv×Æ)O4x(ë¢_,%lEabFoêû³S(IÊK%p?+Ð[s¼ÏIÅ4çX³ regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{LJU50KX1-5I52-VT6Q-WSWM-U2Z9XL21ZV61}\1	1	0	0

Generates some ICMP traffic

Uses WMI to create a new process (1 event)

Time & API	Arguments	Status	Return	Repeated
IWbemServices_ExecMethod Sept. 7, 2021, 12:18 p.m.	inargs.CurrentDirectory: None inargs.CommandLine: rUNdlL32.eXe "C:\Users\test22\AppData\Local\Temp\axhub.dll",main inargs.ProcessStartupInformation: None outargs.ProcessId: 2248 outargs.ReturnValue: 0 flags: 0 method: Create class: Win32_Process	1	0	0

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Lionic	Trojan.Win32.Crypt.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.Inject4.13781
MicroWorld-eScan	Trojan.GenericKD.37263539
FireEye	Trojan.GenericKD.37263539
CAT-QuickHeal	Trojan.Agent
ALYac	Trojan.GenericKD.37263539
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.3399235
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Trojan:Win32/Kryptik.54869754
K7GW	Trojan ( 0057f23b1 )
K7AntiVirus	Trojan ( 0057f23b1 )
Cyren	W32/Trojan.VJVU-7820
ESET-NOD32	a variant of Win32/Kryptik.HLQQ
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Packed.Zusy-9878432-0
Kaspersky	HEUR:Trojan.Win32.Crypt.gen
BitDefender	Trojan.GenericKD.37263539
NANO-Antivirus	Trojan.Win32.Inject4.ixgvgd
Avast	Win32:MalwareX-gen [Trj]
Ad-Aware	Trojan.GenericKD.37263539
Sophos	Mal/Generic-S
Comodo	Malware@#2fm7k45x1wj9i
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0PH221
McAfee-GW-Edition	GenericRXPL-AM!ADFE31C40569
Emsisoft	Trojan.Crypt (A)
Jiangmin	Trojan.Crypt.fma
Webroot	W32.Trojan.Gen
Avira	TR/AD.Downloader.jqeqy
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Generic.ASMalwS.340C0ED
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Trojan.Win32.Gen.oa!s1
Microsoft	Trojan:Win32/Multiverze
ViRobot	Trojan.Win32.Z.Crypt.729724.C
GData	Win32.Trojan.PSE.13QHYFZ
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.R431137
McAfee	GenericRXPL-AM!ADFE31C40569
TACHYON	Trojan/W32.Crypt.729724
VBA32	Trojan.Inject
Malwarebytes	Trojan.Crypt
TrendMicro-HouseCall	TROJ_GEN.R002C0PH221
Tencent	Malware.Win32.Gencirc.10ce6651
Ikarus	Trojan.Win32.Crypt
Fortinet	PossibleThreat.MU
AVG	Win32:MalwareX-gen [Trj]

3cc0e0be954dc849581f9ff1817647de.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All