Polution_v0.7b_windows_64.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | May 20, 2022, 1:17 p.m. | May 20, 2022, 1:43 p.m. |
-
Polution_v0.7b_windows_64.exe "C:\Users\test22\AppData\Local\Temp\Polution_v0.7b_windows_64.exe"
2788-
cmd.exe C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\test22\AppData\Local\Temp\Polution_v0.7b_windows_64.exe
2404-
choice.exe choice /C Y /N /D Y /T 0
2460
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
| IP Address | Status | Action |
|---|---|---|
| No hosts contacted. | ||
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data |
| file | C:\Users\test22\AppData\Local\Chromium\User Data |
| file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data |
| file | C:\Users\test22\AppData\Local\Nichrome\User Data |
| file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data |
| cmdline | C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\test22\AppData\Local\Temp\Polution_v0.7b_windows_64.exe |
| wmi | SELECT * FROM Win32_Process |
| section | {u'size_of_data': u'0x00406c00', u'virtual_address': u'0x009c1000', u'entropy': 7.99995378549436, u'name': u'UPX1', u'virtual_size': u'0x00407000'} | entropy | 7.99995378549 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.999878743786 | description | Overall entropy of this PE file is high | |||||||||||
| section | UPX0 | description | Section name indicates UPX | ||||||
| section | UPX1 | description | Section name indicates UPX | ||||||
| section | UPX2 | description | Section name indicates UPX | ||||||
| cmdline | C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\test22\AppData\Local\Temp\Polution_v0.7b_windows_64.exe |
| Bkav | W32.TikpaBenQ.Trojan |
| Lionic | Trojan.Win64.BroPass.i!c |
| Elastic | malicious (moderate confidence) |
| MicroWorld-eScan | Trojan.GenericKD.39442567 |
| FireEye | Trojan.GenericKD.39442567 |
| CAT-QuickHeal | Trojanpws.Win64 |
| McAfee | Artemis!1DCAED15EA8D |
| Cylance | Unsafe |
| Sangfor | Trojan.Win32.Save.a |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Alibaba | TrojanPSW:Win64/BroPass.657b63a0 |
| K7GW | Trojan ( 005909e21 ) |
| K7AntiVirus | Trojan ( 005909e21 ) |
| Arcabit | Trojan.Generic.D259D887 |
| Cyren | W64/Agent.EBR.gen!Eldorado |
| Symantec | Trojan.Gen.2 |
| ESET-NOD32 | a variant of Generik.IRYLUBP |
| TrendMicro-HouseCall | TROJ_GEN.R002C0WD722 |
| Paloalto | generic.ml |
| Kaspersky | Trojan-PSW.Win64.BroPass.aal |
| BitDefender | Trojan.GenericKD.39442567 |
| Avast | FileRepMalware |
| Tencent | Win64.Trojan-qqpass.Qqrob.Ecle |
| Ad-Aware | Trojan.GenericKD.39442567 |
| Comodo | Malware@#1ayiq4c2kgsos |
| DrWeb | Trojan.MulDrop20.175 |
| Zillya | Trojan.BroPass.Win64.240 |
| TrendMicro | TROJ_GEN.R002C0WD722 |
| Emsisoft | Trojan.GenericKD.39442567 (B) |
| APEX | Malicious |
| Jiangmin | Trojan.PSW.BroPass.eu |
| Webroot | W32.Trojan.GenKD |
| Avira | TR/Redcap.qwrvp |
| MAX | malware (ai score=83) |
| Kingsoft | Win32.PSWTroj.Undef.(kcloud) |
| Gridinsoft | Ransom.Win64.TrickBot.cl |
| Microsoft | Trojan:Win32/Tiggre!rfn |
| GData | Trojan.GenericKD.39442567 |
| Cynet | Malicious (score: 100) |
| AhnLab-V3 | Trojan/Win.TrickBot.C5094234 |
| Acronis | suspicious |
| VBA32 | TrojanPSW.Win64.BroPass |
| ALYac | Trojan.GenericKD.39442567 |
| Malwarebytes | Malware.AI.4125681589 |
| Ikarus | Trojan.WinGo.Agent |
| Rising | Stealer.BroPass!8.13424 (CLOUD) |
| Yandex | Trojan.PWS.BroPass!pCaOOizfod8 |
| MaxSecure | Trojan.Malware.300983.susgen |
| Fortinet | Malicious_Behavior.SB |
| AVG | FileRepMalware |