RedHat.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | March 31, 2023, 4:34 p.m. | March 31, 2023, 4:34 p.m. |
-
RedHat.exe "C:\Users\test22\AppData\Local\Temp\RedHat.exe"
2552
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
| IP Address | Status | Action |
|---|---|---|
| 91.107.196.27 | Active | Moloch |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
| section | .rdata0 |
| section | .rdata1 |
| section | .rdata2 |
| suspicious_features | POST method with no referer header, POST method with no useragent header, Connection to IP address | suspicious_request | POST http://91.107.196.27/75e7ead3c17835de.php | ||||||
| request | POST http://91.107.196.27/75e7ead3c17835de.php |
| request | POST http://91.107.196.27/75e7ead3c17835de.php |
| section | {u'size_of_data': u'0x0004d800', u'virtual_address': u'0x00141000', u'entropy': 6.827706751050602, u'name': u'.rdata', u'virtual_size': u'0x0004d7ec'} | entropy | 6.82770675105 | description | A section with a high entropy has been found | |||||||||
| section | {u'size_of_data': u'0x00001c00', u'virtual_address': u'0x001ef000', u'entropy': 7.027211128496423, u'name': u'.idata', u'virtual_size': u'0x00001a14'} | entropy | 7.0272111285 | description | A section with a high entropy has been found | |||||||||
| section | {u'size_of_data': u'0x005ade00', u'virtual_address': u'0x001f3000', u'entropy': 7.932452029241685, u'name': u'.rdata0', u'virtual_size': u'0x005adc3e'} | entropy | 7.93245202924 | description | A section with a high entropy has been found | |||||||||
| section | {u'size_of_data': u'0x00573800', u'virtual_address': u'0x007a2000', u'entropy': 7.940787160375407, u'name': u'.rdata2', u'virtual_size': u'0x00573800'} | entropy | 7.94078716038 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.876112482238 | description | Overall entropy of this PE file is high | |||||||||||
| host | 91.107.196.27 | |||
| Lionic | Trojan.Win32.Stealerc.4!c |
| MicroWorld-eScan | Trojan.GenericKD.66096642 |
| FireEye | Trojan.GenericKD.66096642 |
| McAfee | Artemis!684B2BDBE523 |
| Malwarebytes | Spyware.Vidar |
| VIPRE | Trojan.GenericKD.66096642 |
| Sangfor | Infostealer.Win32.Agent.V6eu |
| K7AntiVirus | Trojan ( 005a17631 ) |
| BitDefender | Trojan.GenericKD.66096642 |
| K7GW | Trojan ( 005a17631 ) |
| CrowdStrike | win/malicious_confidence_70% (W) |
| BitDefenderTheta | Gen:NN.ZexaF.36344.@Z1@a0qDvRai |
| Elastic | malicious (moderate confidence) |
| ESET-NOD32 | a variant of Generik.JNSZUPP |
| Paloalto | generic.ml |
| Kaspersky | Trojan-PSW.Win32.Stealerc.gq |
| Alibaba | TrojanPSW:Win32/Stealerc.3131803b |
| Tencent | Win32.Trojan-QQPass.QQRob.Simw |
| Sophos | Mal/Generic-S |
| DrWeb | Trojan.Siggen20.17967 |
| McAfee-GW-Edition | Artemis!Trojan |
| Emsisoft | Trojan.GenericKD.66096642 (B) |
| Ikarus | Trojan-Spy.Win32.StealC |
| Webroot | W32.Trojan.Gen |
| Detected | |
| Avira | TR/Redcap.eutkv |
| Antiy-AVL | Trojan[PSW]/Win32.Stealerc |
| Microsoft | Trojan:Win32/Casdet!rfn |
| Gridinsoft | Trojan.Heur!.00212031 |
| Xcitium | Malware@#1jubevf7nilr2 |
| Arcabit | Trojan.Generic.D3F08E02 |
| ZoneAlarm | Trojan-PSW.Win32.Stealerc.gq |
| GData | Win32.Trojan-Stealer.StealC.4HT4ZZ |
| Cynet | Malicious (score: 99) |
| VBA32 | BScope.Backdoor.Agent |
| ALYac | Trojan.GenericKD.66096642 |
| MAX | malware (ai score=80) |
| Cylance | unsafe |
| TrendMicro-HouseCall | TROJ_GEN.R002H0CCP23 |
| Rising | Trojan.Undefined!8.1327C (TFE:5:KlBGkNsNMRQ) |
| Fortinet | W32/PossibleThreat |
| AVG | Win32:Evo-gen [Trj] |
| Avast | Win32:Evo-gen [Trj] |