Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 19, 2022, 5:56 p.m.	Jan. 19, 2022, 5:58 p.m.

Size	5.0MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
MD5	`ca74b9b7f7a2ccb31a3d3976468c94f4`
SHA256	`0816e654fa97490f5a2d844d5d00f3f4557a56dc1a26c184a06df85fbfc2203f`
CRC32	`70BFE7DB`
ssdeep	`98304:pFdcr6LOO/rF857DpdRYb1gnh9qkmgZFFXzHdkSxlxoGd9uJjhnG:BctO/585rRYb1gnfqTsFRRAJhG`
PDB Path	d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet

Generativeness.exe "C:\Users\test22\AppData\Local\Temp\Generativeness.exe"
2776
- Muscletired.exe "C:\Users\test22\AppData\Roaming\Muscletired.exe"
  2852
- 123.exe "C:\Users\test22\AppData\Roaming\123.exe"
  2892

Name	Response	Post-Analysis Lookup
apps.identrust.com	A 121.254.136.27 CNAME a1952.dscq.akamai.net CNAME identrust.edgesuite.net A 121.254.136.57	119.207.65.153
transfer.sh	A 144.76.136.153	144.76.136.153

IP Address	Status	Action
121.254.136.57	Active	Moloch
144.76.136.153	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 19, 2022, 5:56 p.m.			0	0
IsDebuggerPresent Jan. 19, 2022, 5:56 p.m.			0	0
IsDebuggerPresent Jan. 19, 2022, 5:56 p.m.			0	0
IsDebuggerPresent Jan. 19, 2022, 5:56 p.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 19, 2022, 5:56 p.m.		1	1	0

Performs some HTTP requests (1 event)

request

GET http://apps.identrust.com/roots/dstrootcax3.p7c

Allocates read-write-execute memory (usually to unpack itself) (50 out of 160 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ad4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x746e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x746d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x733d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76001000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ae0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef473b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002480000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002620000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40a4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9492a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9493c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a55000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a56000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a57000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe949dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe949e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9492b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 19, 2022, 5:56 p.m.	process_identifier: 2852 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a59000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Roaming\123.exe
file	C:\Users\test22\AppData\Roaming\Muscletired.exe

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Roaming\Muscletired.exe
file	C:\Users\test22\AppData\Roaming\123.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Roaming\123.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Jan. 19, 2022, 5:56 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00050000', u'virtual_address': u'0x00051000', u'entropy': 7.873257086337359, u'name': u'.rsrc', u'virtual_size': u'0x0004ff2c'}

entropy

7.87325708634

description

A section with a high entropy has been found

entropy

0.630541871921

description

Overall entropy of this PE file is high

File has been identified by 43 AntiVirus engines on VirusTotal as malicious (43 events)

Lionic	Trojan.Multi.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.38467804
FireEye	Trojan.GenericKD.38467804
CAT-QuickHeal	TrojanSpy.MSIL
ALYac	Trojan.GenericKD.38467804
Malwarebytes	Malware.AI.4274901897
Sangfor	Riskware.Win32.Agent.ky
K7AntiVirus	Trojan ( 0058cb321 )
Alibaba	TrojanSpy:MSIL/Stealer.b70c377b
K7GW	Trojan ( 0058cb321 )
Cyren	W32/Trojan.GVC.gen!Eldorado
Symantec	Trojan.Gen.MBT
ESET-NOD32	multiple detections
APEX	Malicious
Avast	Win64:MalwareX-gen [Trj]
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.GenericKD.38467804
ViRobot	Trojan.Win32.Z.Wacatac.5208707
Tencent	Win32.Trojan.Multiple.Szuy
Ad-Aware	Trojan.GenericKD.38467804
Sophos	Mal/Generic-S
DrWeb	Trojan.KillProc2.17199
TrendMicro	TROJ_GEN.R002C0WAA22
McAfee-GW-Edition	BehavesLike.Win32.Dropper.rc
Emsisoft	Trojan.GenericKD.38467804 (B)
Paloalto	generic.ml
Avira	TR/Spy.Stealer.jkttq
MAX	malware (ai score=83)
Gridinsoft	Ransom.Win32.Sabsik.ns
Microsoft	Trojan:MSIL/RedLineStealer.MCA!MTB
GData	Trojan.GenericKD.38467804
Cynet	Malicious (score: 100)
McAfee	Artemis!CA74B9B7F7A2
VBA32	Trojan.Sabsik.FL
Cylance	Unsafe
TrendMicro-HouseCall	TROJ_GEN.R002H0DA722
Rising	Malware.Obfus/MSIL@AI.91 (RDM.MSIL:f3oEoHrb1APsH41CDZM9AA)
Yandex	Trojan.DL.Agent!DGg7Q9wQHHI
SentinelOne	Static AI - Malicious SFX
Fortinet	MSIL/Agent_AGen.IG!tr
AVG	Win64:MalwareX-gen [Trj]
Panda	Trj/CI.A

Generativeness.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All