Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | Jan. 26, 2022, 7:47 a.m. | Jan. 26, 2022, 7:49 a.m. |
Name | Response | Post-Analysis Lookup |
---|---|---|
No hosts contacted. |
IP Address | Status | Action |
---|---|---|
62.197.136.186 | Active | Moloch |
Suricata Alerts
Suricata TLS
No Suricata TLS
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
file | C:\Program Files (x86)\Google\Chrome\Application\chrome.exe |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox |
section | CODE |
section | DATA |
section | BSS |
suspicious_features | POST method with no referer header, HTTP version 1.0 used, Connection to IP address | suspicious_request | POST http://62.197.136.186/baba/Panel/five/fre.php |
request | POST http://62.197.136.186/baba/Panel/five/fre.php |
request | POST http://62.197.136.186/baba/Panel/five/fre.php |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Login Data |
file | C:\Users\test22\AppData\Local\Chromium\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data |
file | C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Default\Login Data |
file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data |
file | C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Login Data |
file | C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox |
file | C:\Program Files (x86)\Microsoft Office\Office12\DSSM.EXE |
file | C:\Program Files (x86)\Hnc\HncUtils\HncUpdate.exe |
file | C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateCore.exe |
file | C:\Program Files (x86)\Microsoft Office\Office12\REGFORM.EXE |
file | C:\Python27\Lib\site-packages\setuptools\cli-32.exe |
file | C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\ODSERV.EXE |
file | C:\Python27\Scripts\easy_install.exe |
file | C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE |
file | C:\MSOCache\All Users\{90120000-0030-0000-0000-0000000FF1CE}-C\ose.exe |
file | C:\Python27\Lib\site-packages\pip\_vendor\distlib\w32.exe |
file | C:\tmptqb9ww\bin\Procmon.exe |
file | C:\Users\test22\AppData\Local\Temp\nsnE409.tmp\olgykg.dll |
file | C:\Program Files (x86)\Hnc\Common80\HimTrayIcon.exe |
file | C:\Program Files (x86)\Hnc\Hwp80\HwpFinder.exe |
file | C:\Program Files (x86)\Microsoft Office\Office12\SELFCERT.EXE |
file | C:\Program Files (x86)\Microsoft Office\Office12\PPTVIEW.EXE |
file | C:\Program Files (x86)\Microsoft Office\Office12\MSPUB.EXE |
file | C:\Program Files (x86)\EditPlus\editplus.exe |
file | C:\Python27\Lib\site-packages\pip\_vendor\distlib\t64.exe |
file | C:\Program Files (x86)\Hnc\Hwp80\HwpPrnMng.exe |
file | C:\Python27\Lib\site-packages\pip\_vendor\distlib\t32.exe |
file | C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE |
file | C:\Program Files (x86)\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE |
file | C:\MSOCache\All Users\{90120000-006E-0412-0000-0000000FF1CE}-C\DW20.EXE |
file | C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateComRegisterShell64.exe |
file | C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateBroker.exe |
file | C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler64.exe |
file | C:\util\TCPView\Tcpvcon.exe |
file | C:\Program Files (x86)\Google\Chrome\Application\65.0.3325.181\Installer\chrmstp.exe |
file | C:\Program Files (x86)\Hnc\Common80\HncReporter.exe |
file | C:\Program Files (x86)\Microsoft Office\Office12\1042\ONELEV.EXE |
file | C:\Program Files (x86)\Google\Chrome\Application\chrome.exe |
file | C:\Program Files (x86)\Hnc\Hwp80\HncPUAConverter.exe |
file | C:\Program Files (x86)\Microsoft Office\Office12\MSTORE.EXE |
file | C:\Program Files (x86)\Hnc\HncDic80\HncDic.exe |
file | C:\Program Files (x86)\Microsoft Office\Office12\MSTORDB.EXE |
file | C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\ACECNFLT.EXE |
file | C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdate.exe |
file | C:\Program Files (x86)\Hnc\Hwp80\Hwp.exe |
file | C:\Program Files (x86)\Hnc\HncUtils\KeyLayout\KeyLayout.exe |
file | C:\util\dotnet4.5.exe |
file | C:\Program Files (x86)\Google\Update\GoogleUpdate.exe |
file | C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\winamp58_3660_beta_full_en-us[1].exe |
file | C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE |
file | C:\Program Files (x86)\Microsoft Office\Office12\INFOPATH.EXE |
file | C:\Program Files (x86)\Microsoft Office\Office12\GrooveMigrator.exe |
file | C:\Program Files (x86)\Hnc\PDF80\x64\HNCE2PPRCONV80.exe |
file | C:\Program Files (x86)\Hnc\Common80\him\HJIMESV.EXE |
file | C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateOnDemand.exe |
file | C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\OINFOP12.EXE |
file | C:\Users\test22\AppData\Local\Temp\nsnE409.tmp\olgykg.dll |
file | C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\winamp58_3660_beta_full_en-us[1].exe |
host | 62.197.136.186 |
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default) | reg_value | C:\Windows\svchost.com "%1" %* |
file | C:\Program Files (x86)\FTPGetter\Profile\servers.xml |
file | C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml |
file | C:\Users\test22\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat |
file | C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini |
file | C:\Users\test22\AppData\Roaming\wcx_ftp.ini |
file | C:\Windows\wcx_ftp.ini |
file | C:\Users\test22\wcx_ftp.ini |
file | C:\Windows\32BitFtp.ini |
file | C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml |
file | C:\Program Files (x86)\FileZilla\Filezilla.xml |
file | C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml |
file | C:\Users\test22\AppData\Roaming\FileZilla\filezilla.xml |
registry | HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts |
registry | HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts |
registry | HKEY_CURRENT_USER\Software\Ghisler\Total Commander |
registry | HKEY_CURRENT_USER\Software\VanDyke\SecureFX |
registry | HKEY_CURRENT_USER\Software\LinasFTP\Site Manager |
registry | HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings |
registry | HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions |
registry | HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions |
registry | HKEY_CURRENT_USER\Software\Martin Prikryl |
registry | HKEY_LOCAL_MACHINE\Software\Martin Prikryl |
file | C:\Users\test22\AppData\Roaming\.purple\accounts.xml |
registry | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird |
registry | HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook |
Bkav | W32.NeshtaB.PE |
Elastic | malicious (high confidence) |
DrWeb | Win32.HLLP.Neshta |
MicroWorld-eScan | Win32.Neshta.A |
FireEye | Generic.mg.d81601b026293324 |
CAT-QuickHeal | W32.Neshta.C8 |
McAfee | W32/HLLP.41472.e |
Cylance | Unsafe |
Zillya | Virus.Neshta.Win32.1 |
Sangfor | Virus.Win32.Neshta.a |
K7AntiVirus | Virus ( 00556e571 ) |
K7GW | Virus ( 00556e571 ) |
Cybereason | malicious.026293 |
BitDefenderTheta | AI:FileInfector.D5C3B0640E |
VirIT | Win32.Delf.FE |
Cyren | W32/Neshta.OBIX-2981 |
Symantec | W32.Neshuta |
ESET-NOD32 | Win32/Neshta.A |
TrendMicro-HouseCall | PE_NESHTA.A |
ClamAV | Win.Trojan.Neshuta-1 |
Kaspersky | Virus.Win32.Neshta.a |
BitDefender | Win32.Neshta.A |
NANO-Antivirus | Trojan.Win32.Winlock.fmobyw |
Tencent | Virus.Win32.Neshta.a |
Ad-Aware | Win32.Neshta.A |
Emsisoft | Win32.Neshta.A (B) |
Comodo | Win32.Neshta.A@3ypg |
Baidu | Win32.Virus.Neshta.a |
VIPRE | Virus.Win32.Neshta.a (v) |
TrendMicro | PE_NESHTA.A |
McAfee-GW-Edition | BehavesLike.Win32.HLLP.dc |
SentinelOne | Static AI - Malicious PE |
Sophos | ML/PE-A + W32/Neshta-D |
Ikarus | Virus.Win32.Neshta |
Jiangmin | Virus.Neshta.a |
Avira | W32/Neshta.A |
Antiy-AVL | Trojan/Generic.ASVirus.20D |
Microsoft | Virus:Win32/Neshta.A |
Gridinsoft | Virus.Neshta.A.sd!yf |
Arcabit | Win32.Neshta.A |
ViRobot | Win32.Neshta.Gen.A |
GData | Win32.Virus.Neshta.D |
Cynet | Malicious (score: 100) |
AhnLab-V3 | Win32/Neshta.Gen |
Acronis | suspicious |
ALYac | Win32.Neshta.A |
TACHYON | Virus/W32.Neshta |
VBA32 | Virus.Win32.Neshta.a |
Malwarebytes | Virus.Neshta |
Panda | W32/Neshta.A |