Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | March 17, 2023, 7:34 a.m. | March 17, 2023, 7:36 a.m. |
Name | Response | Post-Analysis Lookup |
---|---|---|
No hosts contacted. |
IP Address | Status | Action |
---|---|---|
138.201.198.8 | Active | Moloch |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
section | _RDATA |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma~RF3a15fe.TMP |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\7605\_metadata |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\35cf191bbfb16c57bf0fad4c6d42cbbbb627202651ea3fe12aefa803c33bd64c.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\ |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_metadata |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\a4b90990b418581487bb13a2cc67700a3c359804f91bdfb8e377cd0ec80ddc10.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\4494652eb0eeceafc44007d8a8fe28c0dae682bed8cb31b53fd33396b5b681a8.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\7605\LICENSE |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\747eda8331ad331091219cce254f4270c2bffd5e422008c6373579e6107bcc56.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\46a555eb75fa912030b5a28969f4f37d112c4174befd49b885abf2fc70fe6d47.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256 |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\ |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics-spare.pma |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\63f2dbcde83bcc2ccf0b728427576b33a48d61778fbd75a638b1c768544bd88d.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\reports\ |
file | C:\Users\test22\AppData\Local\Google\Chrome\ |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\7605\ |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\ee4bbdb775ce60bae142691fabe19e66a30f7e5fb072d88300c47b897aa8fdcb.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\bbd9dfbc1f8a71b593942397aa927b473857950aab52e81a909664368e1ed185.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cache |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\07b75c1be57d68fff1b0c61d2315c7bae6577c5794b76aeebc613a1a69d3a21c.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\6f5376ac31f03119d89900a45115ff77151c11d902c10029068db2089a37d913.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\c652a0ec48ceb3fcab170992c43a87413309e80065a26252401ba3362a17c565.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\b21e05cc8ba2cd8a204e8766f92bb98a2520676bdafa70e7b249532def8b905e.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\fe446108b1d01ab78a62ccfeab6ab2b2babff3abdad80a4d8b30df2d0008830c.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\f65c942fd1773022145418083094568ee34d131933bfdf0c2f200bcc4ef164e3.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_metadata\ |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\7a328c54d8b72db620ea38e0521ee98416703213854d3bd22bc13a57a352eb52.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\7605\_metadata\verified_contents.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\5ea773f9df56c0e7b536487dd049e0327a919a0c84a112128418759681714558.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\manifest.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\7605 |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\ |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\ |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\68f698f81f6482be3a8ceeb9281d4cfc71515d6793d444d10a67acbb4f4ffbc4.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\ |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\5cdc4392fee6ab4544b15e9ad456e61037fbd5fa47dca17394b25ee6f6c70eca.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\7d3ef2f88fff88556824c2c0ca9e5289792bc50e78097f2e6a9768997e22f0d7.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\metadata |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\e83ed0da3ef5063532e75728bc896bc903d3cbd1116beceb69e1777d6d06bd6e.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\2979bef09e393921f056739f63a577e5be577d9c600af8f94d5d265c255dc784.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\ |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\open1.png.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\agent.pyw.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\click.txt.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\office_2007.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\open.PNG.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Help.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\computer.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\click.py.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox Guest Additions\Website.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\util.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\Settings.ini.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent.pyw - 바로 가기.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Chrome.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\한글2010(정품).lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\테스트.txt.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\sn.txt.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Private Character Editor.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\Office.2010.Toolkit.and.EZ-Activator.v2.1.5.Final.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\1234.zip.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\한글2010(정품) (2).lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\agent.py.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Command Prompt.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\SendTo\EditPlus.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\readme.txt.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\시리얼넘버.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\age.pyw.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\click.pyw.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Ease of Access.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\시작프로그램.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Magnify.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\다운로드.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\Python27.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\exit.png.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Run.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Chrome.lnk |
cmdline | cmd /C "wmic path win32_VideoController get name" |
cmdline | cmd /C "wmic cpu get name" |
cmdline | wmic os get Caption |
cmdline | wmic path win32_VideoController get name |
cmdline | wmic cpu get name |
section | {u'size_of_data': u'0x002f8c00', u'virtual_address': u'0x00022000', u'entropy': 7.336518255970433, u'name': u'.rsrc', u'virtual_size': u'0x002f8afd'} | entropy | 7.33651825597 | description | A section with a high entropy has been found | |||||||||
entropy | 0.961757269279 | description | Overall entropy of this PE file is high |
cmdline | cmd /C "wmic path win32_VideoController get name" |
cmdline | cmd /C "wmic cpu get name" |
cmdline | wmic os get Caption |
cmdline | wmic path win32_VideoController get name |
cmdline | wmic cpu get name |
host | 138.201.198.8 |
file | C:\Users\test22\AppData\Roaming\Mozilla\Firefox\Profiles\qxo5wa6x.default-release\parent.lock |
Lionic | Trojan.Win32.Generic.4!c |
Elastic | malicious (high confidence) |
MicroWorld-eScan | Trojan.GenericKD.65948346 |
FireEye | Generic.mg.e309c8e66cb96303 |
McAfee | Artemis!E309C8E66CB9 |
Malwarebytes | Spyware.Aurora |
VIPRE | Trojan.GenericKD.65940663 |
Sangfor | Infostealer.Win64.Agent.Vdwx |
CrowdStrike | win/malicious_confidence_100% (D) |
Arcabit | Trojan.Generic.D3EE4ABA |
Symantec | ML.Attribute.HighConfidence |
ESET-NOD32 | a variant of Generik.CKYFYFJ |
APEX | Malicious |
Cynet | Malicious (score: 100) |
Kaspersky | Trojan-PSW.Win64.Coins.ke |
BitDefender | Trojan.GenericKD.65948346 |
Avast | Win64:PWSX-gen [Trj] |
Tencent | Win64.Trojan-QQPass.QQRob.Aujl |
Emsisoft | Trojan.GenericKD.65948346 (B) |
TrendMicro | TrojanSpy.Win64.AURORASTEALER.YXDCOZ |
Sophos | Generic ML PUA (PUA) |
Webroot | W32.Trojan.Casdet |
Avira | HEUR/AGEN.1252650 |
MAX | malware (ai score=86) |
Antiy-AVL | Trojan/Win32.Sabsik |
Gridinsoft | Malware.Win64.Sabsik.cc |
Xcitium | Malware@#2zq6fhhfnv2i9 |
Microsoft | Trojan:Win32/Casdet!rfn |
GData | Trojan.GenericKD.65948346 |
Detected | |
AhnLab-V3 | Trojan/Win.Generic.C5395713 |
Acronis | suspicious |
ALYac | Trojan.GenericKD.65939128 |
TrendMicro-HouseCall | TrojanSpy.Win64.AURORASTEALER.YXDCOZ |
Rising | Trojan.Undefined!8.1327C (TFE:5:hm8XUiEnfpE) |
Ikarus | Trojan.SuspectCRC |
AVG | Win64:PWSX-gen [Trj] |