Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6403_us | Oct. 10, 2023, 4:57 p.m. | Oct. 10, 2023, 4:59 p.m. |
-
cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "gCzNwAYFCCgC" C:\Users\test22\AppData\Local\Temp\i-5.8-6.Sakura
1372-
rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\test22\AppData\Local\Temp\i-5.8-6.Sakura
2088-
editplus.exe "editplus.exe"
2588
-
-
-
explorer.exe C:\Windows\Explorer.EXE
1236
Name | Response | Post-Analysis Lookup |
---|---|---|
No hosts contacted. |
IP Address | Status | Action |
---|---|---|
No hosts contacted. |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
file | C:\Program Files (x86)\Google\Chrome\Application\chrome.exe |
file | c:\program files\mozilla firefox\firefox.exe |
file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk |
file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EditPlus.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk |
file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk |
file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Chrome.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk |
file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk |
file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk |
file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\Word 2013.lnk |
file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk |
file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\displayswitch.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk |
file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk |
description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
description | (no description) | rule | DebuggerHiding__Thread | ||||||
description | (no description) | rule | DebuggerHiding__Active | ||||||
description | (no description) | rule | ThreadControl__Context | ||||||
description | (no description) | rule | SEH__vectored | ||||||
description | Checks if being debugged | rule | anti_dbg | ||||||
description | Bypass DEP | rule | disable_dep |
registry | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\EDITPLUS.EXE |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Mozilla Thunderbird\Capabilities\Hidden |
Elastic | Linux.Trojan.Gafgyt |
MicroWorld-eScan | Trojan.Linux.Generic.213351 |
FireEye | Trojan.Linux.Generic.213351 |
Skyhigh | GenericRXLY-DY!934037EF82E2 |
ALYac | Trojan.Linux.Generic.213351 |
Sangfor | Suspicious.Linux.Save.a |
Varist | E32/Gafgyt.F.gen!Camelot |
Arcabit | Trojan.Linux.Generic.D34167 |
BitDefenderTheta | Gen:NN.Mirai.36738 |
VirIT | Linux.BackDoor.Fgt.Q |
Symantec | Linux.Mirai |
ESET-NOD32 | a variant of Linux/Gafgyt.ARN |
TrendMicro-HouseCall | Backdoor.Linux.BASHLITE.SMJC10 |
Avast | ELF:Mirai-ARL [Trj] |
ClamAV | Unix.Dropper.Mirai-7138865-0 |
Kaspersky | HEUR:Backdoor.Linux.Gafgyt.cw |
BitDefender | Trojan.Linux.Generic.213351 |
Emsisoft | Trojan.Linux.Generic.213351 (B) |
F-Secure | Exploit.EXP/ELF.Mirai.Gen.Z.A |
DrWeb | Linux.Siggen.9999 |
VIPRE | Trojan.Linux.Generic.213351 |
TrendMicro | Backdoor.Linux.BASHLITE.SMJC10 |
GData | Trojan.Linux.Generic.213351 |
Jiangmin | Backdoor.Linux.fjmb |
Detected | |
Avira | EXP/ELF.Mirai.Gen.Z.A |
MAX | malware (ai score=81) |
Antiy-AVL | Trojan[Backdoor]/Linux.Gafgyt.cw |
Kingsoft | elf.Mirai.2002004 |
Microsoft | Backdoor:Linux/Gafgyt.A!MTB |
ZoneAlarm | HEUR:Backdoor.Linux.Gafgyt.cw |
Avast-Mobile | ELF:Mirai-AXU [Trj] |
Cynet | Malicious (score: 99) |
AhnLab-V3 | Linux/Gafgyt.Gen26 |
McAfee | GenericRXLY-DY!934037EF82E2 |
Rising | Backdoor.Mirai/Linux!1.E868 (CLASSIC) |
Ikarus | Trojan.Linux.Gafgyt |
MaxSecure | Trojan.Malware.121218.susgen |
Fortinet | Linux/Mirai.TJ!tr |
AVG | ELF:Mirai-ARL [Trj] |