ab.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6402 | Sept. 8, 2021, 5:29 p.m. | Sept. 8, 2021, 5:35 p.m. |
-
ab.exe "C:\Users\test22\AppData\Local\Temp\ab.exe"
2340
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| img.neko.airforce | 167.172.239.151 |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 167.172.239.151:443 -> 192.168.56.102:49167 | 2029340 | ET INFO TLS Handshake Failure | Potentially Bad Traffic |
| TCP 192.168.56.102:49165 -> 167.172.239.151:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.102:49164 -> 167.172.239.151:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
No Suricata TLS
| Elastic | malicious (high confidence) |
| FireEye | Generic.mg.d35a920b33e638e4 |
| Cylance | Unsafe |
| Cybereason | malicious.212de5 |
| BitDefenderTheta | Gen:NN.ZexaF.34126.auW@aO!axQfi |
| Cyren | W32/Agent.DJF.gen!Eldorado |
| ESET-NOD32 | Win32/TrojanDownloader.Agent.FVU |
| APEX | Malicious |
| Kaspersky | VHO:Trojan.Win32.Convagent.gen |
| NANO-Antivirus | Virus.Win32.Gen.ccmw |
| Avast | Win32:MalwareX-gen [Trj] |
| Rising | Trojan.Generic@ML.88 (RDML:jPZdi1CGbiAOp4e+nWK+bg) |
| VIPRE | Lookslike.Win32.Sirefef.c!ag (v) |
| Microsoft | Trojan:Script/Phonzy.C!ml |
| VBA32 | BScope.Trojan.Injects |
| SentinelOne | Static AI - Malicious PE |
| AVG | Win32:MalwareX-gen [Trj] |
| CrowdStrike | win/malicious_confidence_60% (D) |
| MaxSecure | Trojan.Malware.300983.susgen |