expo.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | Sept. 15, 2023, 5:25 p.m. | Sept. 15, 2023, 5:34 p.m. |
-
AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3388
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49165 -> 5.42.92.211:80 | 2047625 | ET MALWARE [ANY.RUN] Win32/Stealc Checkin (POST) | A Network Trojan was detected |
| TCP 192.168.56.101:49165 -> 5.42.92.211:80 | 2018358 | ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 | Potentially Bad Traffic |
Suricata TLS
No Suricata TLS
| pdb_path | C:\AziX5sd0UIh45JJEBNErGAvcuDPjdvkT\Ghost.pdb |
| section | .00cfg |
| packer | Microsoft Visual C++ V8.0 (Debug) |
| suspicious_features | POST method with no referer header, Connection to IP address | suspicious_request | POST http://5.42.92.211/loghub/master | ||||||
| request | POST http://5.42.92.211/loghub/master |
| request | POST http://5.42.92.211/loghub/master |
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| host | 5.42.92.211 | |||
| Bkav | W32.AIDetectMalware |
| MicroWorld-eScan | Trojan.Agent.GGRT |
| FireEye | Trojan.Agent.GGRT |
| McAfee | Artemis!F94BF3A0E373 |
| Malwarebytes | Spyware.PasswordStealer |
| Sangfor | Backdoor.Win32.Injector.V0st |
| Alibaba | Backdoor:Win32/Injector.301c4936 |
| Cyren | W32/Kryptik.KRA.gen!Eldorado |
| Symantec | ML.Attribute.HighConfidence |
| Elastic | malicious (high confidence) |
| ESET-NOD32 | a variant of Win32/Injector.ETFD |
| Cynet | Malicious (score: 100) |
| APEX | Malicious |
| ClamAV | Win.Malware.Exploitx-9967939-0 |
| Kaspersky | HEUR:Backdoor.Win32.Agent.gen |
| BitDefender | Trojan.Agent.GGRT |
| Avast | Win32:Evo-gen [Trj] |
| DrWeb | Trojan.KillProc2.21446 |
| TrendMicro | Trojan.Win32.SMOKELOADER.YXDIOZ |
| McAfee-GW-Edition | Artemis!Trojan |
| Sophos | Mal/Generic-S |
| Ikarus | Win32.Outbreak |
| Webroot | W32.Trojan.Gen |
| Antiy-AVL | Trojan/Win32.Injector |
| Microsoft | Trojan:Win32/Znyonm |
| Gridinsoft | Ransom.Win32.Sabsik.sa |
| Arcabit | Trojan.Agent.GGRT |
| ZoneAlarm | HEUR:Backdoor.Win32.Agent.gen |
| Detected | |
| MAX | malware (ai score=80) |
| Cylance | unsafe |
| Panda | Trj/Genetic.gen |
| Rising | Backdoor.Agent!8.C5D (TFE:5:CeppGcuQMQO) |
| MaxSecure | Trojan.Malware.121218.susgen |
| Fortinet | W32/Injector.ETFD!tr |
| AVG | Win32:Evo-gen [Trj] |
| DeepInstinct | MALICIOUS |
| CrowdStrike | win/malicious_confidence_100% (W) |