Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 29, 2023, 10:09 a.m.	March 29, 2023, 10:13 a.m.

Size	1.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`3769516d37fcc4a870aee040c22dfc81`
SHA256	`6199dea22769be27718efc834dac97781ded77e3fc4e0eceb281016e73a61c8c`
CRC32	`EE46DACB`
ssdeep	`6144:F+/ljQhToWxUIvq7w1MLBkZEAO7x8Lk+POSHe8dXvLx/pIW4:Fij0ToWx/vRE78tPOSHVXbIW4`
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) PE_Header_Zero - PE File Signature

99.exe "C:\Users\test22\AppData\Local\Temp\99.exe"
1952
- RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  444

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
45.15.156.16	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 29, 2023, 10:09 a.m.			0	0
IsDebuggerPresent March 29, 2023, 10:09 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (14 events)

Time & API	Arguments	Status	Return
CryptExportKey March 29, 2023, 10:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00868f40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 10:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00868f40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 10:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00868f40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 10:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00868f40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 10:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00868fc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 10:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00868fc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 10:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00868ec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 10:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00868ec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 10:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00868ec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 10:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00868ec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 10:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00868ec0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 10:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00868f40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 10:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00868f40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 10:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00869140 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 29, 2023, 10:09 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sda12

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 29, 2023, 10:09 a.m.	stacktrace: 99+0x2739 @ 0xcf2739 99+0x82c5 @ 0xcf82c5 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.esp: 3340552 registers.edi: 5111808 registers.eax: 444 registers.ebp: 3340624 registers.edx: 2130566132 registers.ebx: 1024 registers.esi: 13955680 registers.ecx: 524	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (34 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d4f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 1952 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00440000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00510000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d52000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02200000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ad1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Yara rule detected in process memory (9 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	RedLine stealer	rule	RedLine_Stealer_m_Zero

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: ec0273d43c83178e3525ed5e2f8bbcad0763a1a3

Communicates with host for which no DNS query was performed (1 event)

host

45.15.156.16

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000054	1	0	0

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory March 29, 2023, 10:09 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 444 process_handle: 0x00000054	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1952 called NtSetContextThread to modify thread in remote process 444
NtSetContextThread March 29, 2023, 10:09 a.m.	registers.eip: 2005598660 registers.esp: 3669176 registers.edi: 0 registers.eax: 4306310 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000050 process_identifier: 444	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1952 resumed a thread in remote process 444
NtResumeThread March 29, 2023, 10:09 a.m.	thread_handle: 0x00000050 suspend_count: 1 process_identifier: 444	1	0	0

Executed a process and injected code into it, probably while unpacking (10 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW March 29, 2023, 10:09 a.m.	thread_identifier: 632 thread_handle: 0x00000050 process_identifier: 444 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000054	1	1
NtGetContextThread March 29, 2023, 10:09 a.m.	thread_handle: 0x00000050	1	0
NtAllocateVirtualMemory March 29, 2023, 10:09 a.m.	process_identifier: 444 region_size: 204800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000054	1	0
WriteProcessMemory March 29, 2023, 10:09 a.m.	buffer: base_address: 0x00400000 process_identifier: 444 process_handle: 0x00000054	1	1
WriteProcessMemory March 29, 2023, 10:09 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 444 process_handle: 0x00000054	1	1
NtSetContextThread March 29, 2023, 10:09 a.m.	registers.eip: 2005598660 registers.esp: 3669176 registers.edi: 0 registers.eax: 4306310 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000050 process_identifier: 444	1	0
NtResumeThread March 29, 2023, 10:09 a.m.	thread_handle: 0x00000050 suspend_count: 1 process_identifier: 444	1	0
NtResumeThread March 29, 2023, 10:09 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 444	1	0
NtResumeThread March 29, 2023, 10:09 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 444	1	0
NtResumeThread March 29, 2023, 10:09 a.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 444	1	0

File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 events)

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Stealer.12!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.455311
McAfee	GenericRXAA-AA!3769516D37FC
Malwarebytes	Backdoor.Crypt
VIPRE	Gen:Variant.Zusy.455311
Sangfor	Trojan.Win32.Save.a
Alibaba	Malware:Win32/km_2ce0e.None
K7GW	Trojan ( 0059edff1 )
Arcabit	Trojan.Zusy.D6F28F
Cyren	W32/Kryptik.JEO.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HSQQ
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-Spy.Win32.Stealer.gen
BitDefender	Gen:Variant.Zusy.455311
Avast	Win32:PWSX-gen [Trj]
Tencent	Malware.Win32.Gencirc.118e0e67
Sophos	ML/PE-A
DrWeb	Trojan.PWS.Stealer.35327
TrendMicro	TrojanSpy.Win32.REDLINE.YXDC1Z
McAfee-GW-Edition	BehavesLike.Win32.Generic.tz
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.3769516d37fcc4a8
Emsisoft	Gen:Variant.Zusy.455311 (B)
SentinelOne	Static AI - Suspicious PE
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1363295
MAX	malware (ai score=89)
Antiy-AVL	Trojan/Win32.Kryptik
Gridinsoft	Malware.Win32.Kryptik.cc
Microsoft	Trojan:Win32/Redline.GHA!MTB
GData	Gen:Variant.Zusy.455311
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5401785
BitDefenderTheta	Gen:NN.ZexaF.36344.evW@ayyFwak
TrendMicro-HouseCall	TrojanSpy.Win32.REDLINE.YXDC1Z
Rising	Trojan.Kryptik!1.E268 (CLASSIC)
Ikarus	Trojan.Win32.Raccoon
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/GenKryptik.GAWR!tr
AVG	Win32:PWSX-gen [Trj]
Panda	Trj/Chgt.AD

99.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All