popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

svchost.exe

Generic Malware Downloader HTTP ScreenShot Create Service KeyLogger Internet API P2P DGA Http API persistence FTP Socket Escalate priviledges DNS Code injection PWS Sniff Audio Steal credential AntiDebug PE File AntiVM PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 5, 2023, 7:40 a.m. Oct. 5, 2023, 7:44 a.m.
Size 2.5MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e9724f79d09583b45931d5040f02eb35
SHA256 65f68c86b215ee6c93a9c4f56eda6748e4af7d49589c69a3a5f96f5734468c25
CRC32 77F15C4F
ssdeep 49152:G/qJ1DLVsbF0nYqZfZonTzexyNXXzusxw13NTKWW8h+lle2dfhg5QbvZDx79Ow8:wQ1tI0YqZRonI+CGC3NTxW8h+esfhg5N
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • themida_packer - themida packer
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
158.101.44.242 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: The system cannot find the path specified.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: Could Not Find C:\Users\test22\AppData\Local\Temp\s19s.2
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "O" has successfully been created.
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section
section .imports
section .themida
section .boot
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
svchost+0x367dc0 @ 0x757dc0
svchost+0x385d60 @ 0x775d60

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc000008e
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 3274556
registers.edi: 4403200
registers.eax: 3274556
registers.ebp: 3274636
registers.edx: 2130566132
registers.ebx: 0
registers.esi: 2006021163
registers.ecx: 783351808
1 0 0

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.instruction_r:
        ed e9 43 d3 01 00 b9 0a 00 00 00 e9 00 00 00 00
        

      
        exception.symbol:
        svchost+0x3982a4
        

      
        exception.instruction:
        in eax, dx
        

      
        exception.module:
        svchost.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        3768996
        

      
        exception.address:
        0x7882a4
        

      
    
  
    
      
        registers.esp:
        3274676
        

      
        registers.edi:
        13840001
        

      
        registers.eax:
        1750617430
        

      
        registers.ebp:
        4403200
        

      
        registers.edx:
        13850710
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        3522540
        

      
        registers.ecx:
        20
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        ed e9 cb f5 ff ff c3 e9 6d 17 00 00 2e 05 fe ff
        

      
        exception.symbol:
        svchost+0x3c33aa
        

      
        exception.instruction:
        in eax, dx
        

      
        exception.module:
        svchost.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        3945386
        

      
        exception.address:
        0x7b33aa
        

      
    
  
    
      
        registers.esp:
        3274676
        

      
        registers.edi:
        13840001
        

      
        registers.eax:
        1447909480
        

      
        registers.ebp:
        4403200
        

      
        registers.edx:
        22104
        

      
        registers.ebx:
        2256917605
        

      
        registers.esi:
        3522540
        

      
        registers.ecx:
        10
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          
o+0x367dc0 @ 0xed7dc0
o+0x385d60 @ 0xef5d60

        
      
      
      

    
  
    
      
        exception.instruction_r:
        c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
        

      
        exception.symbol:
        RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
        

      
        exception.instruction:
        leave
        

      
        exception.module:
        KERNELBASE.dll
        

      
        exception.exception_code:
        0xc000008e
        

      
        exception.offset:
        46887
        

      
        exception.address:
        0x7559b727
        

      
    
  
    
      
        registers.esp:
        2160720
        

      
        registers.edi:
        12267520
        

      
        registers.eax:
        2160720
        

      
        registers.ebp:
        2160800
        

      
        registers.edx:
        2130566132
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        2006021163
        

      
        registers.ecx:
        1078263808
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        ed e9 43 d3 01 00 b9 0a 00 00 00 e9 00 00 00 00
        

      
        exception.symbol:
        o+0x3982a4
        

      
        exception.instruction:
        in eax, dx
        

      
        exception.module:
        O.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        3768996
        

      
        exception.address:
        0xf082a4
        

      
    
  
    
      
        registers.esp:
        2160840
        

      
        registers.edi:
        4533967
        

      
        registers.eax:
        1750617430
        

      
        registers.ebp:
        12267520
        

      
        registers.edx:
        4544598
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        4177900
        

      
        registers.ecx:
        20
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        ed e9 cb f5 ff ff c3 e9 6d 17 00 00 2e 05 fe ff
        

      
        exception.symbol:
        o+0x3c33aa
        

      
        exception.instruction:
        in eax, dx
        

      
        exception.module:
        O.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        3945386
        

      
        exception.address:
        0xf333aa
        

      
    
  
    
      
        registers.esp:
        2160840
        

      
        registers.edi:
        4533967
        

      
        registers.eax:
        1447909480
        

      
        registers.ebp:
        12267520
        

      
        registers.edx:
        22104
        

      
        registers.ebx:
        2256917605
        

      
        registers.esi:
        4177900
        

      
        registers.ecx:
        10
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1648
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          8192
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x7793f000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1648
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          8192
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x778b0000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1648
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x0042a000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1648
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x0041a000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1648
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x0041a000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1648
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          69632
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x0041a000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2280
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          8192
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x7793f000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2280
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          8192
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x778b0000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2280
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00baa000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2280
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00b9a000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2280
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00b9a000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2280
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          69632
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00b9a000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            O.exe tried to sleep 214 seconds, actually delayed analysis time by 214 seconds
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    file
                                    C:\ProgramData\Roaming\O.exe
                                    
                                


                            

                        

                            

                                

                                    file
                                    C:\Users\test22\AppData\Local\Temp\s19s.0.bat
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    cmdline
                                    schtasks.exe /create /sc MINUTE /mo 1 /RL HIGHEST /tn "O" /tr C:\ProgramData\Roaming\O.exe /f
                                    
                                


                            

                        

                            

                                

                                    cmdline
                                    "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "O" /tr C:\ProgramData\Roaming\O.exe /f
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    file
                                    C:\Users\test22\AppData\Local\Temp\s19s.0.bat
                                    
                                


                            

                        

                            

                                

                                    file
                                    C:\ProgramData\Roaming\O.exe
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
ShellExecuteExW

  
  
    
      
    
  


  
    
      show_type:
      
        
          0
        
      
      
      

    
  
    
      filepath_r:
      
        
          C:\Users\test22\AppData\Local\Temp\s19s.0.bat
        
      
      
      

    
  
    
      parameters:
      
        
          
        
      
      
      

    
  
    
      filepath:
      
        
          C:\Users\test22\AppData\Local\Temp\s19s.0.bat
        
      
      
      

    
  


    
        1
    

1

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
ShellExecuteExW

  
  
    
      
    
  


  
    
      show_type:
      
        
          0
        
      
      
      

    
  
    
      filepath_r:
      
        
          schtasks.exe
        
      
      
      

    
  
    
      parameters:
      
        
          /create /sc MINUTE /mo 1 /RL HIGHEST /tn "O" /tr C:\ProgramData\Roaming\O.exe /f
        
      
      
      

    
  
    
      filepath:
      
        
          schtasks.exe
        
      
      
      

    
  


    
        1
    

1

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x00015b42', u'virtual_address': u'0x00001000', u'entropy': 7.98672106093825, u'name': u'        ', u'virtual_size': u'0x00028bb1'}
                                        
                                    
                                        
                                            entropy
                                            7.98672106094
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x000074e2', u'virtual_address': u'0x0002a000', u'entropy': 7.920922017106033, u'name': u'        ', u'virtual_size': u'0x00010fa2'}
                                        
                                    
                                        
                                            entropy
                                            7.92092201711
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x000003a2', u'virtual_address': u'0x0003b000', u'entropy': 7.672336236475749, u'name': u'        ', u'virtual_size': u'0x00001fcc'}
                                        
                                    
                                        
                                            entropy
                                            7.67233623648
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x000002b4', u'virtual_address': u'0x0003d000', u'entropy': 7.601103100535755, u'name': u'        ', u'virtual_size': u'0x00000598'}
                                        
                                    
                                        
                                            entropy
                                            7.60110310054
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x00001e73', u'virtual_address': u'0x0003e000', u'entropy': 7.925579813836141, u'name': u'        ', u'virtual_size': u'0x000026f0'}
                                        
                                    
                                        
                                            entropy
                                            7.92557981384
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x0026beb2', u'virtual_address': u'0x0042b000', u'entropy': 7.951856481172703, u'name': u'.boot', u'virtual_size': u'0x0026c000'}
                                        
                                    
                                        
                                            entropy
                                            7.95185648117
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            entropy
                                            0.9992328068
                                        
                                    
                                        
                                            description
                                            Overall entropy of this PE file is high
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            Create a windows service
                                        
                                    
                                        
                                            rule
                                            Create_Service
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            Communications over RAW Socket
                                        
                                    
                                        
                                            rule
                                            Network_TCP_Socket
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            Communication using DGA
                                        
                                    
                                        
                                            rule
                                            Network_DGA
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            Match Windows Http API call
                                        
                                    
                                        
                                            rule
                                            Str_Win32_Http_API
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            Take ScreenShot
                                        
                                    
                                        
                                            rule
                                            ScreenShot
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            Escalate priviledges
                                        
                                    
                                        
                                            rule
                                            Escalate_priviledges
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            Steal credential
                                        
                                    
                                        
                                            rule
                                            local_credential_Steal
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            PWS Memory
                                        
                                    
                                        
                                            rule
                                            Generic_PWS_Memory_Zero
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            Record Audio
                                        
                                    
                                        
                                            rule
                                            Sniff_Audio
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            Communications over HTTP
                                        
                                    
                                        
                                            rule
                                            Network_HTTP
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            Communications use DNS
                                        
                                    
                                        
                                            rule
                                            Network_DNS
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            Code injection with CreateRemoteThread in a remote process
                                        
                                    
                                        
                                            rule
                                            Code_injection
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            (no description)
                                        
                                    
                                        
                                            rule
                                            DebuggerCheck__GlobalFlags
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            (no description)
                                        
                                    
                                        
                                            rule
                                            DebuggerCheck__QueryInfo
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            (no description)
                                        
                                    
                                        
                                            rule
                                            DebuggerCheck__RemoteAPI
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            (no description)
                                        
                                    
                                        
                                            rule
                                            DebuggerHiding__Thread
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            (no description)
                                        
                                    
                                        
                                            rule
                                            DebuggerHiding__Active
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            (no description)
                                        
                                    
                                        
                                            rule
                                            DebuggerException__ConsoleCtrl
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            (no description)
                                        
                                    
                                        
                                            rule
                                            DebuggerException__SetConsoleCtrl
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            (no description)
                                        
                                    
                                        
                                            rule
                                            ThreadControl__Context
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            (no description)
                                        
                                    
                                        
                                            rule
                                            SEH__vectored
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            (no description)
                                        
                                    
                                        
                                            rule
                                            Check_Dlls
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            Checks if being debugged
                                        
                                    
                                        
                                            rule
                                            anti_dbg
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            Anti-Sandbox checks for ThreatExpert
                                        
                                    
                                        
                                            rule
                                            antisb_threatExpert
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            Bypass DEP
                                        
                                    
                                        
                                            rule
                                            disable_dep
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            Affect hook table
                                        
                                    
                                        
                                            rule
                                            win_hook
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            File Downloader
                                        
                                    
                                        
                                            rule
                                            Network_Downloader
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            Match Windows Inet API call
                                        
                                    
                                        
                                            rule
                                            Str_Win32_Internet_API
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            Install itself for autorun at Windows startup
                                        
                                    
                                        
                                            rule
                                            Persistence
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            Communications over FTP
                                        
                                    
                                        
                                            rule
                                            Network_FTP
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            Run a KeyLogger
                                        
                                    
                                        
                                            rule
                                            KeyLogger
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            Communications over P2P network
                                        
                                    
                                        
                                            rule
                                            Network_P2P_Win
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    cmdline
                                    schtasks.exe /create /sc MINUTE /mo 1 /RL HIGHEST /tn "O" /tr C:\ProgramData\Roaming\O.exe /f
                                    
                                


                            

                        

                            

                                

                                    cmdline
                                    "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "O" /tr C:\ProgramData\Roaming\O.exe /f
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                            host
                                            158.101.44.242
                                        
                                    
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          RegmonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          RegmonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Registry Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          18467-41
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          File Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          PROCMON_WINDOW_CLASS
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Process Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          RegmonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          RegmonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Registry Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          18467-41
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          File Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          PROCMON_WINDOW_CLASS
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Process Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Regmonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Regmonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          18467-41
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Filemonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Filemonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          PROCMON_WINDOW_CLASS
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Regmonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Regmonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          18467-41
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Filemonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Filemonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          PROCMON_WINDOW_CLASS
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Regmonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Regmonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          18467-41
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Filemonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Filemonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          PROCMON_WINDOW_CLASS
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Regmonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Regmonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          18467-41
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Filemonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Filemonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          PROCMON_WINDOW_CLASS
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Regmonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Regmonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          18467-41
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Filemonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Filemonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          PROCMON_WINDOW_CLASS
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Regmonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Regmonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    registry
                                    HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
                                    
                                


                            

                        

                            

                                

                                    registry
                                    HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    cmdline
                                    schtasks.exe /create /sc MINUTE /mo 1 /RL HIGHEST /tn "O" /tr C:\ProgramData\Roaming\O.exe /f
                                    
                                


                            

                        

                            

                                

                                    cmdline
                                    "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "O" /tr C:\ProgramData\Roaming\O.exe /f
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    Process injection
                                    Process 2168 resumed a thread in remote process 2280
                                    
                                


                            

                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
NtResumeThread

  
  
    
      
    
  


  
    
      thread_handle:
      
        
          0x00000088
        
      
      
      

    
  
    
      suspend_count:
      
        
          0
        
      
      
      

    
  
    
      process_identifier:
      
        
          2280
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    registry
                                    HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
NtQuerySystemInformation

  
  
    
      
    
  


  
    
      information_class:
      
        
          76
        
      
      
        (SystemFirmwareTableInformation)
      
      

    
  


    

3221225507

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        ed e9 cb f5 ff ff c3 e9 6d 17 00 00 2e 05 fe ff
        

      
        exception.symbol:
        svchost+0x3c33aa
        

      
        exception.instruction:
        in eax, dx
        

      
        exception.module:
        svchost.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        3945386
        

      
        exception.address:
        0x7b33aa
        

      
    
  
    
      
        registers.esp:
        3274676
        

      
        registers.edi:
        13840001
        

      
        registers.eax:
        1447909480
        

      
        registers.ebp:
        4403200
        

      
        registers.edx:
        22104
        

      
        registers.ebx:
        2256917605
        

      
        registers.esi:
        3522540
        

      
        registers.ecx:
        10
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    Bkav
                                    W32.AIDetectMalware
                                    
                                


                            

                        

                            

                                

                                    Lionic
                                    Trojan.Win32.Tcczq.4!c
                                    
                                


                            

                        

                            

                                

                                    Elastic
                                    malicious (high confidence)
                                    
                                


                            

                        

                            

                                

                                    DrWeb
                                    Trojan.MulDrop23.64664
                                    
                                


                            

                        

                            

                                

                                    MicroWorld-eScan
                                    Gen:Trojan.Heur.JM0@tCCzQ3ck
                                    
                                


                            

                        

                            

                                

                                    FireEye
                                    Generic.mg.e9724f79d09583b4
                                    
                                


                            

                        

                            

                                

                                    ALYac
                                    Gen:Trojan.Heur.JM0@tCCzQ3ck
                                    
                                


                            

                        

                            

                                

                                    Cylance
                                    unsafe
                                    
                                


                            

                        

                            

                                

                                    Sangfor
                                    Trojan.Win32.Packed.Vibb
                                    
                                


                            

                        

                            

                                

                                    CrowdStrike
                                    win/malicious_confidence_100% (W)
                                    
                                


                            

                        

                            

                                

                                    Alibaba
                                    Packed:Win32/Themida.1e606fa0
                                    
                                


                            

                        

                            

                                

                                    BitDefenderTheta
                                    AI:Packer.D8CA0DCE23
                                    
                                


                            

                        

                            

                                

                                    Symantec
                                    ML.Attribute.HighConfidence
                                    
                                


                            

                        

                            

                                

                                    tehtris
                                    Generic.Malware
                                    
                                


                            

                        

                            

                                

                                    ESET-NOD32
                                    a variant of Win32/Packed.Themida.IIJ
                                    
                                


                            

                        

                            

                                

                                    Cynet
                                    Malicious (score: 99)
                                    
                                


                            

                        

                            

                                

                                    APEX
                                    Malicious
                                    
                                


                            

                        

                            

                                

                                    Kaspersky
                                    Trojan-Banker.Win32.ClipBanker.zlj
                                    
                                


                            

                        

                            

                                

                                    BitDefender
                                    Gen:Trojan.Heur.JM0@tCCzQ3ck
                                    
                                


                            

                        

                            

                                

                                    NANO-Antivirus
                                    Virus.Win32.Gen-Crypt.ccnc
                                    
                                


                            

                        

                            

                                

                                    Avast
                                    Win32:TrojanX-gen [Trj]
                                    
                                


                            

                        

                            

                                

                                    Tencent
                                    Win32.Trojan.Crypt.Rgil
                                    
                                


                            

                        

                            

                                

                                    Emsisoft
                                    Gen:Trojan.Heur.JM0@tCCzQ3ck (B)
                                    
                                


                            

                        

                            

                                

                                    F-Secure
                                    Trojan.TR/Crypt.FKM.Gen
                                    
                                


                            

                        

                            

                                

                                    VIPRE
                                    Gen:Trojan.Heur.JM0@tCCzQ3ck
                                    
                                


                            

                        

                            

                                

                                    TrendMicro
                                    TROJ_GEN.R002C0XJ423
                                    
                                


                            

                        

                            

                                

                                    McAfee-GW-Edition
                                    BehavesLike.Win32.Generic.vc
                                    
                                


                            

                        

                            

                                

                                    Trapmine
                                    malicious.high.ml.score
                                    
                                


                            

                        

                            

                                

                                    Sophos
                                    Mal/Generic-S
                                    
                                


                            

                        

                            

                                

                                    SentinelOne
                                    Static AI - Suspicious PE
                                    
                                


                            

                        

                            

                                

                                    Webroot
                                    W32.Trojan.Gen
                                    
                                


                            

                        

                            

                                

                                    Avira
                                    TR/Crypt.FKM.Gen
                                    
                                


                            

                        

                            

                                

                                    MAX
                                    malware (ai score=87)
                                    
                                


                            

                        

                            

                                

                                    Kingsoft
                                    malware.kb.a.862
                                    
                                


                            

                        

                            

                                

                                    Microsoft
                                    Trojan:Win32/Znyonm
                                    
                                


                            

                        

                            

                                

                                    Gridinsoft
                                    Trojan.Heur!.032100A1
                                    
                                


                            

                        

                            

                                

                                    Arcabit
                                    Trojan.Heur.E22C7F
                                    
                                


                            

                        

                            

                                

                                    ZoneAlarm
                                    Trojan-Banker.Win32.ClipBanker.zlj
                                    
                                


                            

                        

                            

                                

                                    GData
                                    Gen:Trojan.Heur.JM0@tCCzQ3ck
                                    
                                


                            

                        

                            

                                

                                    VBA32
                                    BScope.Trojan.Wacatac
                                    
                                


                            

                        

                            

                                

                                    Malwarebytes
                                    Trojan.Waldek
                                    
                                


                            

                        

                            

                                

                                    Panda
                                    Trj/Chgt.AC
                                    
                                


                            

                        

                            

                                

                                    Zoner
                                    Probably Heur.ExeHeaderL
                                    
                                


                            

                        

                            

                                

                                    TrendMicro-HouseCall
                                    TROJ_GEN.R002C0XJ423
                                    
                                


                            

                        

                            

                                

                                    Rising
                                    Trojan.Generic@AI.100 (RDML:uToJMgzyOkVqGCVajyOrUg)
                                    
                                


                            

                        

                            

                                

                                    Ikarus
                                    Trojan.Win32.Themida
                                    
                                


                            

                        

                            

                                

                                    MaxSecure
                                    Trojan.Malware.300983.susgen
                                    
                                


                            

                        

                            

                                

                                    Fortinet
                                    W32/PossibleThreat
                                    
                                


                            

                        

                            

                                

                                    AVG
                                    Win32:TrojanX-gen [Trj]
                                    
                                


                            

                        

                            

                                

                                    Cybereason
                                    malicious.725663