file.zip| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6402 | March 17, 2023, 6:10 p.m. | March 17, 2023, 6:13 p.m. |
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
| IP Address | Status | Action |
|---|---|---|
| 164.124.101.2 | Active | Moloch |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 175.208.134.153:62996 -> 192.168.56.102:5911 | 2002911 | ET SCAN Potential VNC Scan 5900-5920 | Attempted Information Leak |
Suricata TLS
No Suricata TLS
| Elastic | malicious (moderate confidence) |
| Cynet | Malicious (score: 99) |
| ESET-NOD32 | a variant of Win32/Kryptik.HRZC |
| Kaspersky | HEUR:Trojan.Win32.Kryptik.gen |
| F-Secure | Heuristic.HEUR/AGEN.1255782 |
| Avira | TR/Dropper.Gen |
| ZoneAlarm | HEUR:Trojan.Win32.Kryptik.gen |
| Detected | |
| Ikarus | Trojan.Win32.Crypt |