28.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6403_us | Jan. 9, 2023, 9:36 a.m. | Jan. 9, 2023, 9:52 a.m. |
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| t.me | 149.154.167.99 | |
| steamcommunity.com | 104.76.78.101 |
Suricata Alerts
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.103:49169 23.37.146.163:443 |
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Extended Validation Server CA | unknown=US, unknown=Washington, unknown=Private Organization, serialNumber=602 290 773, C=US, ST=Washington, L=Bellevue, O=Valve Corp, CN=store.steampowered.com | b1:30:5e:4c:ee:14:70:87:a7:d7:1c:77:07:b5:3c:2c:99:13:aa:c5 |
| suspicious_features | GET method with no useragent header, Connection to IP address | suspicious_request | GET http://116.202.7.135/804 | ||||||
| suspicious_features | GET method with no useragent header, Connection to IP address | suspicious_request | GET http://116.202.7.135/samefiles.zip | ||||||
| request | GET http://116.202.7.135/804 |
| request | GET http://116.202.7.135/samefiles.zip |
| request | GET https://steamcommunity.com/profiles/76561199467421923 |
| section | {u'size_of_data': u'0x00070c00', u'virtual_address': u'0x00002000', u'entropy': 7.6462856416103095, u'name': u'.text', u'virtual_size': u'0x00070a72'} | entropy | 7.64628564161 | description | A section with a high entropy has been found | |||||||||
| section | {u'size_of_data': u'0x00004400', u'virtual_address': u'0x00074000', u'entropy': 7.721087347356225, u'name': u'.rsrc', u'virtual_size': u'0x000042a6'} | entropy | 7.72108734736 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.998932764141 | description | Overall entropy of this PE file is high | |||||||||||
| url | http://65.108.93.119:80 |
| url | https://t.me/year2023start |
| url | http://www.smartassembly.com/webservices/Reporting/UploadReport2 |
| url | http://www.smartassembly.com/webservices/UploadReportLogin/ |
| url | https://steamcommunity.com/profiles/76561199467421923 |
| url | http://www.smartassembly.com/webservices/UploadReportLogin/GetServerURL |
| url | http://www.smartassembly.com/webservices/Reporting/L |
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | Win32 PWS Loki | rule | Win32_PWS_Loki_Zero | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| host | 116.202.7.135 | |||
| url | http://65.108.93.119:80 |
| Bkav | W32.AIDetectNet.01 |
| Lionic | Trojan.Win32.Bandra.4!c |
| MicroWorld-eScan | Gen:Variant.MSILHeracles.55372 |
| FireEye | Generic.mg.6f165f33d7d16f38 |
| CAT-QuickHeal | Trojan.MSIL |
| McAfee | Artemis!6F165F33D7D1 |
| Cylance | Unsafe |
| Sangfor | Suspicious.Win32.Save.a |
| K7AntiVirus | Trojan ( 0059cd1a1 ) |
| Alibaba | Trojan:Win32/Kryptik.ali2000016 |
| K7GW | Trojan ( 0059cd1a1 ) |
| Cybereason | malicious.a7adc7 |
| Arcabit | Trojan.Lazy.D450C9 |
| BitDefenderTheta | Gen:NN.ZemsilF.36158.Dm0@aOnI5lmG |
| Cyren | W32/ABRisk.BVSQ-8903 |
| Symantec | ML.Attribute.HighConfidence |
| Elastic | malicious (high confidence) |
| ESET-NOD32 | Win32/PSW.Agent.ONW |
| APEX | Malicious |
| Kaspersky | HEUR:Trojan-Banker.MSIL.Bandra.gen |
| BitDefender | Gen:Variant.Lazy.282825 |
| Avast | Win32:RATX-gen [Trj] |
| Tencent | Msil.Trojan-Banker.Bandra.Adhl |
| Ad-Aware | Gen:Variant.MSILHeracles.55372 |
| Emsisoft | Gen:Variant.Lazy.282825 (B) |
| Comodo | Malware@#1uw07hdg05zx |
| VIPRE | Gen:Variant.MSILHeracles.55372 |
| TrendMicro | TrojanSpy.Win32.VIDAR.YXDAFZ |
| McAfee-GW-Edition | BehavesLike.Win32.Fareit.gc |
| Trapmine | malicious.high.ml.score |
| Sophos | Mal/Generic-S + Mal/MSIL-VD |
| SentinelOne | Static AI - Malicious PE |
| Webroot | W32.Trojan.MSIL.Bandra |
| Detected | |
| Avira | TR/AD.GenSteal.jcatq |
| MAX | malware (ai score=82) |
| Antiy-AVL | Trojan/MSIL.Kryptik |
| Kingsoft | Win32.Troj.Banker.(kcloud) |
| Gridinsoft | Malware.Win32.Sabsik.cc |
| Microsoft | Trojan:Win32/Woreflint.A!cl |
| GData | Gen:Variant.Lazy.282825 |
| Cynet | Malicious (score: 100) |
| ALYac | Gen:Variant.Lazy.282825 |
| Malwarebytes | Trojan.Crypt.MSIL |
| TrendMicro-HouseCall | TrojanSpy.Win32.VIDAR.YXDAFZ |
| Rising | Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:hKwpbcthsRDW8kvfsdrWOQ) |
| Ikarus | Trojan.MSIL.MultiPacked |
| MaxSecure | Trojan.Malware.300983.susgen |
| Fortinet | W32/Malicious_Behavior.VEX |
| AVG | Win32:RATX-gen [Trj] |