ctp2.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | Oct. 5, 2021, 9:52 a.m. | Oct. 5, 2021, 10:08 a.m. |
-
ctp2.exe "C:\Users\test22\AppData\Local\Temp\ctp2.exe"
1684
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
| registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
| registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox |
| section | .x |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data |
| file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Default\Login Data |
| file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data |
| file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data |
| file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Login Data |
| file | C:\Users\test22\AppData\Local\Chromium\User Data\Default\Web Data |
| file | C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data |
| file | C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Default\Login Data |
| file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data |
| file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data |
| file | C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Login Data |
| file | C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data |
| file | C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Web Data |
| file | C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Login Data |
| file | C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Web Data |
| file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data |
| file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data |
| registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey |
| registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox |
| host | 165.227.31.192 | |||
| file | C:\Program Files (x86)\FTPGetter\Profile\servers.xml |
| file | C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml |
| file | C:\Users\test22\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat |
| file | C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini |
| file | C:\Users\test22\AppData\Roaming\wcx_ftp.ini |
| file | C:\Windows\wcx_ftp.ini |
| file | C:\Users\test22\wcx_ftp.ini |
| file | C:\Windows\32BitFtp.ini |
| file | C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml |
| file | C:\Program Files (x86)\FileZilla\Filezilla.xml |
| file | C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml |
| file | C:\Users\test22\AppData\Roaming\FileZilla\filezilla.xml |
| registry | HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts |
| registry | HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts |
| registry | HKEY_CURRENT_USER\Software\Ghisler\Total Commander |
| registry | HKEY_CURRENT_USER\Software\VanDyke\SecureFX |
| registry | HKEY_CURRENT_USER\Software\LinasFTP\Site Manager |
| registry | HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings |
| registry | HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions |
| registry | HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions |
| registry | HKEY_CURRENT_USER\Software\Martin Prikryl |
| registry | HKEY_LOCAL_MACHINE\Software\Martin Prikryl |
| file | C:\Users\test22\AppData\Roaming\.purple\accounts.xml |
| registry | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook |
| registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird |
| registry | HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook |
| Bkav | W32.AIDetect.malware1 |
| Lionic | Trojan.Win32.naKocTb.tnB5 |
| Elastic | malicious (high confidence) |
| Cynet | Malicious (score: 100) |
| FireEye | Generic.mg.67b984f729d6f745 |
| CAT-QuickHeal | Trojan.Mauvaise.SL1 |
| McAfee | LokiBot!67B984F729D6 |
| Cylance | Unsafe |
| Sangfor | Suspicious.Win32.Save.a |
| K7AntiVirus | Password-Stealer ( 004d88671 ) |
| Alibaba | TrojanPSW:Win32/Agentb.50a60e51 |
| K7GW | Password-Stealer ( 004d88671 ) |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cyren | W32/S-f2ff7de9!Eldorado |
| Symantec | SMG.Heur!gen |
| ESET-NOD32 | Win32/PSW.Fareit.L |
| APEX | Malicious |
| Paloalto | generic.ml |
| ClamAV | Win.Trojan.Autoit-7057849-0 |
| Kaspersky | Trojan.Win32.Agentb.bvrg |
| BitDefender | Trojan.PWS.ZKD |
| NANO-Antivirus | Trojan.Win32.Stealer.eshrhl |
| SUPERAntiSpyware | Trojan.Agent/Gen-PasswordStealer |
| MicroWorld-eScan | Trojan.PWS.ZKD |
| Avast | Win32:LokiBot-A [Trj] |
| Tencent | Malware.Win32.Gencirc.10b3c757 |
| Ad-Aware | Trojan.PWS.ZKD |
| Emsisoft | Trojan-PSW.Fareit (A) |
| Comodo | TrojWare.Win32.Fareit.LB@7pzcfo |
| DrWeb | Trojan.PWS.Siggen2.59088 |
| Zillya | Trojan.naKocTb.Win32.12 |
| TrendMicro | TSPY_LOKI.SMA |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.ch |
| Sophos | Mal/Generic-R + Troj/Fareit-CHG |
| SentinelOne | Static AI - Malicious PE |
| Jiangmin | Trojan.naKocTb.l |
| Avira | TR/Crypt.XPACK.Gen |
| MAX | malware (ai score=81) |
| Antiy-AVL | Trojan/Generic.ASMalwS.1B6B4C6 |
| Kingsoft | Win32.Heur.KVMH008.a.(kcloud) |
| Gridinsoft | Malware.Win32.Gen.bot!se39734 |
| Microsoft | PWS:Win32/PrimaryPass.AD!MTB |
| ViRobot | Trojan.Win32.Agent.106496.HD |
| ZoneAlarm | Trojan.Win32.Agentb.bvrg |
| GData | Trojan.PWS.ZKD |
| AhnLab-V3 | Trojan/Win32.Lokibot.R270234 |
| Acronis | suspicious |
| VBA32 | BScope.Trojan.Agentb |
| ALYac | Trojan.PWS.ZKD |
| TACHYON | Trojan/W32.naKocTb.106496 |