Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 25, 2023, 4:58 p.m.	Sept. 25, 2023, 5 p.m.

Size	5.5MB
Type	MS-DOS executable, MZ for MS-DOS
MD5	`a92a908cae30b9b020244bedf61a1dd4`
SHA256	`ae14b287be4c2cb072802d65693beeb9efecefd6e6de5994abe49546b8ca0308`
CRC32	`F89FCD89`
ssdeep	`98304:pHrMX3ZbN6mocwdMpXYI6A2XwY0o7r5QBa2lAo3WTsKVnd/9lSD/WFIxUBzqHy:1MnZZPocwGpoRRXwY9rb2moBKVd/9lEJ`
Yara	UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE32 - (no description) MPRESS_Zero - MPRESS packed file

svchost.exe "C:\Users\test22\AppData\Local\Temp\svchost.exe"
1096
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\sug.0.bat" "
  2124
  - timeout.exe timeout 3
    2184
  - O.exe "C:\ProgramData\Roaming\O.exe"
    2280
    - schtasks.exe "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "O" /tr C:\ProgramData\Roaming\O.exe /f
      2380

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 25, 2023, 4:58 p.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (3 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 25, 2023, 4:58 p.m.	buffer: The system cannot find the path specified. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 25, 2023, 4:58 p.m.	buffer: Could Not Find C:\Users\test22\AppData\Local\Temp\sug.2 console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 25, 2023, 4:58 p.m.	buffer: SUCCESS: The scheduled task "O" has successfully been created. console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 25, 2023, 4:58 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.MPRESS1
section	.MPRESS2

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

TIS

One or more processes crashed (6 events)

Time & API	Arguments	Status
__exception__ Sept. 25, 2023, 4:58 p.m.	stacktrace: svchost+0x2ae741 @ 0x6ae741 svchost+0x36d1df @ 0x76d1df exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1638148 registers.edi: 4468736 registers.eax: 1638148 registers.ebp: 1638228 registers.edx: 2130566132 registers.ebx: 5108719 registers.esi: 2006021163 registers.ecx: 780271616	1
__exception__ Sept. 25, 2023, 4:58 p.m.	stacktrace: exception.instruction_r: ed e9 4c bb 02 00 38 8e ff d0 9c 57 56 be ea 00 exception.symbol: svchost+0x3a1925 exception.instruction: in eax, dx exception.module: svchost.exe exception.exception_code: 0xc0000096 exception.offset: 3807525 exception.address: 0x7a1925 registers.esp: 1638268 registers.edi: 19803777 registers.eax: 1750617430 registers.ebp: 4468736 registers.edx: 19814486 registers.ebx: 0 registers.esi: 4112364 registers.ecx: 20	1
__exception__ Sept. 25, 2023, 4:58 p.m.	stacktrace: exception.instruction_r: ed e9 03 74 07 00 c3 e9 d9 e6 fe ff 9d fd bc 29 exception.symbol: svchost+0x35b50c exception.instruction: in eax, dx exception.module: svchost.exe exception.exception_code: 0xc0000096 exception.offset: 3519756 exception.address: 0x75b50c registers.esp: 1638268 registers.edi: 19803777 registers.eax: 1447909480 registers.ebp: 4468736 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 4112364 registers.ecx: 10	1
__exception__ Sept. 25, 2023, 4:58 p.m.	stacktrace: o+0x2ae741 @ 0x6ae741 o+0x36d1df @ 0x76d1df exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1638148 registers.edi: 4468736 registers.eax: 1638148 registers.ebp: 1638228 registers.edx: 2130566132 registers.ebx: 5108719 registers.esi: 2006021163 registers.ecx: 1143799808	1
__exception__ Sept. 25, 2023, 4:58 p.m.	stacktrace: exception.instruction_r: ed e9 4c bb 02 00 38 8e ff d0 9c 57 56 be ea 00 exception.symbol: o+0x3a1925 exception.instruction: in eax, dx exception.module: O.exe exception.exception_code: 0xc0000096 exception.offset: 3807525 exception.address: 0x7a1925 registers.esp: 1638268 registers.edi: 2895567 registers.eax: 1750617430 registers.ebp: 4468736 registers.edx: 2906198 registers.ebx: 0 registers.esi: 20168684 registers.ecx: 20	1
__exception__ Sept. 25, 2023, 4:58 p.m.	stacktrace: exception.instruction_r: ed e9 03 74 07 00 c3 e9 d9 e6 fe ff 9d fd bc 29 exception.symbol: o+0x35b50c exception.instruction: in eax, dx exception.module: O.exe exception.exception_code: 0xc0000096 exception.offset: 3519756 exception.address: 0x75b50c registers.esp: 1638268 registers.edi: 2895567 registers.eax: 1447909480 registers.ebp: 4468736 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 20168684 registers.ecx: 10	1

Allocates read-write-execute memory (usually to unpack itself) (12 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 25, 2023, 4:58 p.m.	process_identifier: 1096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7793f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 4:58 p.m.	process_identifier: 1096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778b0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 4:58 p.m.	process_identifier: 1096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 4:58 p.m.	process_identifier: 1096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 4:58 p.m.	process_identifier: 1096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 4:58 p.m.	process_identifier: 1096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 4:58 p.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7793f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 4:58 p.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778b0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 4:58 p.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 4:58 p.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 4:58 p.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 4:58 p.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

O.exe tried to sleep 212 seconds, actually delayed analysis time by 212 seconds

Creates executable files on the filesystem (2 events)

file	C:\ProgramData\Roaming\O.exe
file	C:\Users\test22\AppData\Local\Temp\sug.0.bat

Creates a suspicious process (2 events)

cmdline	schtasks.exe /create /sc MINUTE /mo 1 /RL HIGHEST /tn "O" /tr C:\ProgramData\Roaming\O.exe /f
cmdline	"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "O" /tr C:\ProgramData\Roaming\O.exe /f

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 25, 2023, 4:58 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\sug.0.bat parameters: filepath: C:\Users\test22\AppData\Local\Temp\sug.0.bat	1	1	0
ShellExecuteExW Sept. 25, 2023, 4:58 p.m.	show_type: 0 filepath_r: schtasks.exe parameters: /create /sc MINUTE /mo 1 /RL HIGHEST /tn "O" /tr C:\ProgramData\Roaming\O.exe /f filepath: schtasks.exe	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00585e00', u'virtual_address': u'0x00001000', u'entropy': 7.999968697716594, u'name': u'.MPRESS1', u'virtual_size': u'0x00df6000'}

entropy

7.99996869772

description

A section with a high entropy has been found

entropy

0.998058766434

description

Overall entropy of this PE file is high

Potentially malicious URLs were found in the process memory dump (1 event)

url	https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation

Yara rule detected in process memory (32 events)

description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communications over P2P network	rule	Network_P2P_Win
description	Communication using DGA	rule	Network_DGA
description	Steal credential	rule	local_credential_Steal
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Escalate priviledges	rule	Escalate_priviledges
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Take ScreenShot	rule	ScreenShot
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	File Downloader	rule	Network_Downloader

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	schtasks.exe /create /sc MINUTE /mo 1 /RL HIGHEST /tn "O" /tr C:\ProgramData\Roaming\O.exe /f
cmdline	"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "O" /tr C:\ProgramData\Roaming\O.exe /f

Checks for the presence of known windows from debuggers and forensic tools (50 out of 162 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 25, 2023, 4:58 p.m.	class_name: Regmonclass window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Installs itself for autorun at Windows startup (2 events)

cmdline	schtasks.exe /create /sc MINUTE /mo 1 /RL HIGHEST /tn "O" /tr C:\ProgramData\Roaming\O.exe /f
cmdline	"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "O" /tr C:\ProgramData\Roaming\O.exe /f

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\sug.0.bat
file	C:\ProgramData\Roaming\O.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2124 resumed a thread in remote process 2280
NtResumeThread Sept. 25, 2023, 4:58 p.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2280	1	0	0

Detects VirtualBox through the presence of a registry key (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 25, 2023, 4:58 p.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 25, 2023, 4:58 p.m.	stacktrace: exception.instruction_r: ed e9 03 74 07 00 c3 e9 d9 e6 fe ff 9d fd bc 29 exception.symbol: svchost+0x35b50c exception.instruction: in eax, dx exception.module: svchost.exe exception.exception_code: 0xc0000096 exception.offset: 3519756 exception.address: 0x75b50c registers.esp: 1638268 registers.edi: 19803777 registers.eax: 1447909480 registers.ebp: 4468736 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 4112364 registers.ecx: 10	1	0	0

File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 events)

Lionic	Trojan.Win32.ClipBanker.Z!c
Elastic	malicious (high confidence)
DrWeb	Trojan.MulDrop23.44422
MicroWorld-eScan	Trojan.GenericKD.69201665
FireEye	Generic.mg.a92a908cae30b9b0
ALYac	Trojan.GenericKD.69201665
Malwarebytes	Spyware.PasswordStealer
Sangfor	Banker.Win32.Kryptik.Vgc4
K7AntiVirus	Trojan ( 00582a4a1 )
Alibaba	TrojanBanker:Win32/ClipBanker.56169897
K7GW	Trojan ( 00582a4a1 )
Cybereason	malicious.0ae267
Arcabit	Trojan.Generic.D41FEF01
BitDefenderTheta	Gen:NN.ZexaF.36662.@puaaO4qGeki
Cyren	W32/ABRisk.DWIF-3244
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Kryptik.HIYJ
APEX	Malicious
Kaspersky	Trojan-Banker.Win32.ClipBanker.zhr
BitDefender	Trojan.GenericKD.69201665
NANO-Antivirus	Trojan.Win32.ClipBanker.jzxxrj
Avast	Win32:Malware-gen
Rising	Trojan.Kryptik!8.8 (TFE:5:biRMGD3p3sV)
Emsisoft	Trojan.GenericKD.69201665 (B)
F-Secure	Trojan.TR/Spy.Banker.lustj
VIPRE	Trojan.GenericKD.69201665
TrendMicro	TrojanSpy.Win32.LUMMASTEALER.YXDIJZ
McAfee-GW-Edition	BehavesLike.Win32.SoftPulse.tc
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/Spy.Banker.lustj
MAX	malware (ai score=80)
Antiy-AVL	Trojan/Win32.Kryptik
Gridinsoft	Trojan.Win32.Kryptik.sa
Xcitium	Malware@#1pwtybhg0chfp
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ViRobot	Trojan.Win.Z.Kryptik.5803008
ZoneAlarm	Trojan-Banker.Win32.ClipBanker.zhr
GData	Trojan.GenericKD.69201665
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win.Generic.C5480501
McAfee	Artemis!A92A908CAE30
Cylance	unsafe
Panda	Trj/Banker.MK
TrendMicro-HouseCall	TrojanSpy.Win32.LUMMASTEALER.YXDIJZ
Tencent	Malware.Win32.Gencirc.13ef0cc5

svchost.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All