fffffff.exe1| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6403_us | Aug. 2, 2023, 9:51 a.m. | Aug. 2, 2023, 10:15 a.m. |
-
fffffff.exe1 "C:\Users\test22\AppData\Local\Temp\fffffff.exe1"
1208
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| lisfwhite.ch2eck.yaheoo.com | ||
| listwhfite.check3.yaho1o.com |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.103:49165 -> 78.138.9.136:80 | 2033203 | ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B) | Malware Command and Control Activity Detected |
| TCP 192.168.56.103:49162 -> 185.212.47.65:80 | 2033204 | ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F) | Malware Command and Control Activity Detected |
| TCP 192.168.56.103:49167 -> 79.132.130.230:80 | 2033203 | ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B) | Malware Command and Control Activity Detected |
| TCP 192.168.56.103:49166 -> 79.132.130.230:80 | 2033203 | ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B) | Malware Command and Control Activity Detected |
| TCP 192.168.56.103:49164 -> 45.155.249.172:80 | 2033203 | ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B) | Malware Command and Control Activity Detected |
| TCP 192.168.56.103:49164 -> 45.155.249.172:80 | 2033204 | ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F) | Malware Command and Control Activity Detected |
Suricata TLS
No Suricata TLS
| suspicious_features | Connection to IP address | suspicious_request | GET http://185.212.47.65/zerotohero/cdXm_2FVJxK0LegSF/qWrY8fts8Fcq/0NYojf5UlKt/8DhxFr0B_2FsfH/yh95t8o1NlDiZvluicJ4e/y3s9rzRcxmXrVVJ7/Ka_2BqSUQBoccRO/pPeTmlMcibaZ1A8GB4/_2FCWWzpa/5CmD7rRKRlIWq5D4qu77/BGDeyVKNAc3pBFiPPX0/ncnmY9UmOi2ZepGuelaMz6/Fs7cUQ3jbJA0N/WaIYzdmN/W999YPszzQ3zvI2rKp8ilbI/G0MSN_2FTg/61lr6bk_2FfsZ31Jt/feVTEck3UWfb/5ZQcZoVE/Sy48y.asi | ||||||
| suspicious_features | Connection to IP address | suspicious_request | GET http://45.155.249.172/zerotohero/_2BNfe26Q_2BhpzcY80eoW/2IbQqms219ain/8xo_2BRo/O79HFwawAOqR1xwy3PGyFgp/h2FreaMQGU/PghXl8ePxYt85SSHr/L_2B7SHWLYe8/Jvu0omXw0U8/B2o2reD4ai5rDs/W5ZivSf7_2FvcBaSlziH8/2oaBAztGA6DuRQnj/fby_2FNeLRkfUIG/Tb9pBn4LDJSKpggRop/2yOnyRMrq/hGr0R03Qs2AMMI3QMxF8/DcYedNwEbb0WMiSm2cz/GpYewdMSs8Cd7hz_2FvN34/4B_2By8bGbelM/gBrumlN3/yo9.asi | ||||||
| suspicious_features | Connection to IP address | suspicious_request | GET http://78.138.9.136/zerotohero/BOMG5brBej/W6MNwYSFq4lSlX9tT/x4Y3Omef7UGN/WZhhSM2s5vi/V1FDzyIOh5EpoI/CWWIkqKkrw75RSUzXr7ex/W1RxkTyF3m2S3f2E/Y99btwsIJQuuhmN/lw3cuoTnNFNiXX7cu0/2whafmQx2/EkaF2FKoKeqHPMNHsEAQ/keKvvr9l1uzq8oU96Le/2jrUUusg_2B0I6xcr09dJj/XFvFn_2Fm4A8m/UqxdWdhP/VRi2h91sbdwC8lBB_2FDjJW/U_2ButnyPo/M3ehIUmus7lD5zNNn/gajTaRAeV8b6/0zF8WivYdTr/uC4wDLoi/v.asi | ||||||
| suspicious_features | Connection to IP address | suspicious_request | GET http://79.132.130.230/zerotohero/DVrxwIAQMgsf7onOLh/XV75B5oFA/y1vXWahjjQZVMDH_2FiQ/4PZa4sHCsckUL377wx1/ZWvRgGdffXeg9iPEYWZ0h_/2BhA96Rc7xe4R/qby1FhUA/D3J5ocbPv6vcjAoxDEpqdg_/2BxvziDIQC/aLCB4AL9AMx8ac_2B/QNhLbiQcgZin/EpRbwzEa4e4/D_2BKwsvigFCN_/2FBg_2Fw3ZaNSpM8fK07N/yXdvG0NodEjK6LFi/2ZnEMcjmx0YgxZI/dLH_2BvcUmTIQFitsY/hIm1muN9Q/YX6gqoj0w/GcFQn4vTy/4.asi | ||||||
| suspicious_features | Connection to IP address | suspicious_request | GET http://79.132.130.230/zerotohero/K3vk9WJHpEMX6hbZw9tQyo5/AMBJbLu6tj/I4dyyPRvEIc_2Bo5I/2NUNLIkQqXoM/4CLXycYanau/8WFUZdkBqHxj0k/G1Dz8Bb1qnisHoMvqFItJ/4wfCjdP1Gf4MD015/_2Fjg_2BwAknLxt/5g2XdSihMUmd7kf0Vf/ZYb5g5bV4/ib0vVzu4C_2FW6ak5OEU/GWK9iVTriGnuRYnmHaa/jVg20muCMLk3bbDqYb9K4b/WNo_2BGUwzd9k/NzS1SsLQ/d6CTTcaEu36FGNawX2R0Kqo/C38zpv3wa/W12SJCNS.asi | ||||||
| request | GET http://185.212.47.65/zerotohero/cdXm_2FVJxK0LegSF/qWrY8fts8Fcq/0NYojf5UlKt/8DhxFr0B_2FsfH/yh95t8o1NlDiZvluicJ4e/y3s9rzRcxmXrVVJ7/Ka_2BqSUQBoccRO/pPeTmlMcibaZ1A8GB4/_2FCWWzpa/5CmD7rRKRlIWq5D4qu77/BGDeyVKNAc3pBFiPPX0/ncnmY9UmOi2ZepGuelaMz6/Fs7cUQ3jbJA0N/WaIYzdmN/W999YPszzQ3zvI2rKp8ilbI/G0MSN_2FTg/61lr6bk_2FfsZ31Jt/feVTEck3UWfb/5ZQcZoVE/Sy48y.asi |
| request | GET http://45.155.249.172/zerotohero/_2BNfe26Q_2BhpzcY80eoW/2IbQqms219ain/8xo_2BRo/O79HFwawAOqR1xwy3PGyFgp/h2FreaMQGU/PghXl8ePxYt85SSHr/L_2B7SHWLYe8/Jvu0omXw0U8/B2o2reD4ai5rDs/W5ZivSf7_2FvcBaSlziH8/2oaBAztGA6DuRQnj/fby_2FNeLRkfUIG/Tb9pBn4LDJSKpggRop/2yOnyRMrq/hGr0R03Qs2AMMI3QMxF8/DcYedNwEbb0WMiSm2cz/GpYewdMSs8Cd7hz_2FvN34/4B_2By8bGbelM/gBrumlN3/yo9.asi |
| request | GET http://78.138.9.136/zerotohero/BOMG5brBej/W6MNwYSFq4lSlX9tT/x4Y3Omef7UGN/WZhhSM2s5vi/V1FDzyIOh5EpoI/CWWIkqKkrw75RSUzXr7ex/W1RxkTyF3m2S3f2E/Y99btwsIJQuuhmN/lw3cuoTnNFNiXX7cu0/2whafmQx2/EkaF2FKoKeqHPMNHsEAQ/keKvvr9l1uzq8oU96Le/2jrUUusg_2B0I6xcr09dJj/XFvFn_2Fm4A8m/UqxdWdhP/VRi2h91sbdwC8lBB_2FDjJW/U_2ButnyPo/M3ehIUmus7lD5zNNn/gajTaRAeV8b6/0zF8WivYdTr/uC4wDLoi/v.asi |
| request | GET http://79.132.130.230/zerotohero/DVrxwIAQMgsf7onOLh/XV75B5oFA/y1vXWahjjQZVMDH_2FiQ/4PZa4sHCsckUL377wx1/ZWvRgGdffXeg9iPEYWZ0h_/2BhA96Rc7xe4R/qby1FhUA/D3J5ocbPv6vcjAoxDEpqdg_/2BxvziDIQC/aLCB4AL9AMx8ac_2B/QNhLbiQcgZin/EpRbwzEa4e4/D_2BKwsvigFCN_/2FBg_2Fw3ZaNSpM8fK07N/yXdvG0NodEjK6LFi/2ZnEMcjmx0YgxZI/dLH_2BvcUmTIQFitsY/hIm1muN9Q/YX6gqoj0w/GcFQn4vTy/4.asi |
| request | GET http://79.132.130.230/zerotohero/K3vk9WJHpEMX6hbZw9tQyo5/AMBJbLu6tj/I4dyyPRvEIc_2Bo5I/2NUNLIkQqXoM/4CLXycYanau/8WFUZdkBqHxj0k/G1Dz8Bb1qnisHoMvqFItJ/4wfCjdP1Gf4MD015/_2Fjg_2BwAknLxt/5g2XdSihMUmd7kf0Vf/ZYb5g5bV4/ib0vVzu4C_2FW6ak5OEU/GWK9iVTriGnuRYnmHaa/jVg20muCMLk3bbDqYb9K4b/WNo_2BGUwzd9k/NzS1SsLQ/d6CTTcaEu36FGNawX2R0Kqo/C38zpv3wa/W12SJCNS.asi |
| section | {u'size_of_data': u'0x0001f000', u'virtual_address': u'0x00001000', u'entropy': 7.007216587946333, u'name': u'.text', u'virtual_size': u'0x0001e313'} | entropy | 7.00721658795 | description | A section with a high entropy has been found | |||||||||
| section | {u'size_of_data': u'0x0005b000', u'virtual_address': u'0x00020000', u'entropy': 7.982485624268267, u'name': u'.rdata', u'virtual_size': u'0x0005a153'} | entropy | 7.98248562427 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.938461538462 | description | Overall entropy of this PE file is high | |||||||||||
| host | 185.212.47.65 | |||
| host | 45.155.249.172 | |||
| host | 78.138.9.136 | |||
| host | 79.132.130.230 | |||
| Bkav | W32.AIDetectMalware |
| Elastic | malicious (high confidence) |
| FireEye | Generic.mg.12e493f7a5f1d848 |
| Cylance | unsafe |
| Sangfor | Suspicious.Win32.Save.a |
| K7AntiVirus | Trojan ( 00549d461 ) |
| K7GW | Trojan ( 00549d461 ) |
| Cybereason | malicious.347eb6 |
| Symantec | Packed.Generic.553 |
| tehtris | Generic.Malware |
| APEX | Malicious |
| Cynet | Malicious (score: 100) |
| NANO-Antivirus | Virus.Win32.Gen.ccmw |
| Sophos | Mal/EncPk-APX |
| Trapmine | suspicious.low.ml.score |
| SentinelOne | Static AI - Malicious PE |
| Microsoft | Program:Win32/Wacapew.C!ml |
| Detected | |
| BitDefenderTheta | Gen:NN.ZexaF.36348.Gu0@aeWpXDci |
| VBA32 | BScope.Backdoor.Dridex |
| Malwarebytes | MachineLearning/Anomalous.100% |
| Rising | Trojan.Generic@AI.91 (RDML:6zgeAFwHW4a5Z6Nvl7/HQg) |
| MaxSecure | Trojan.Malware.300983.susgen |
| DeepInstinct | MALICIOUS |
| CrowdStrike | win/malicious_confidence_100% (W) |