Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6403_us | Oct. 18, 2023, 9:46 a.m. | Oct. 18, 2023, 9:48 a.m. |
-
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\d-8.dll,
2140 -
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\d-8.dll,Edge
1648
Name | Response | Post-Analysis Lookup |
---|---|---|
No hosts contacted. |
IP Address | Status | Action |
---|---|---|
143.92.58.180 | Active | Moloch |
Suricata Alerts
Suricata TLS
No Suricata TLS
suspicious_features | Connection to IP address | suspicious_request | GET http://143.92.58.180:8000/1 |
request | GET http://143.92.58.180:8000/1 |
file | C:\Users\test22\AppData\Roaming\XsvnGpYsBj.exe |
host | 143.92.58.180 |
Bkav | W32.AIDetectMalware |
Lionic | Trojan.Win32.Lotok.4!c |
MicroWorld-eScan | Gen:Variant.Doina.65070 |
Skyhigh | BehavesLike.Win32.NetLoader.lh |
ALYac | Gen:Variant.Doina.65070 |
Cylance | unsafe |
VIPRE | Gen:Variant.Doina.65070 |
CrowdStrike | win/malicious_confidence_90% (W) |
Alibaba | Backdoor:Win32/Lotok.1d26da00 |
K7GW | Trojan-Downloader ( 005ac8791 ) |
K7AntiVirus | Trojan-Downloader ( 005ac8791 ) |
Symantec | ML.Attribute.HighConfidence |
Elastic | malicious (high confidence) |
ESET-NOD32 | a variant of Win32/TrojanDownloader.Agent.HHI |
APEX | Malicious |
Cynet | Malicious (score: 100) |
Kaspersky | HEUR:Backdoor.Win32.Lotok.gen |
BitDefender | Gen:Variant.Doina.65070 |
Avast | Win32:RATX-gen [Trj] |
Tencent | Trojan.Win32.Agent_yh.16001053 |
Emsisoft | Gen:Variant.Doina.65070 (B) |
F-Secure | Trojan.TR/Dldr.Agent.otkvn |
DrWeb | Trojan.DownLoader46.24420 |
FireEye | Generic.mg.dc62653f9e2468f5 |
Sophos | Mal/Generic-S |
Ikarus | Trojan-Downloader.Win32.Agent |
GData | Gen:Variant.Doina.65070 |
Webroot | W32.Trojan.Agent.Gen |
Detected | |
Avira | TR/Dldr.Agent.otkvn |
Antiy-AVL | Trojan[Backdoor]/Win32.Lotok |
Arcabit | Trojan.Doina.DFE2E |
ZoneAlarm | HEUR:Backdoor.Win32.Lotok.gen |
Microsoft | Trojan:Win32/Casdet!rfn |
Varist | W32/ABRisk.YRPR-3326 |
AhnLab-V3 | Trojan/Win.Generic.C5509670 |
McAfee | Artemis!DC62653F9E24 |
MAX | malware (ai score=85) |
VBA32 | Backdoor.Farfli |
Malwarebytes | Trojan.Downloader |
Panda | Trj/Chgt.AD |
TrendMicro-HouseCall | TROJ_GEN.R002H09JE23 |
Rising | Backdoor.Lotok!8.111D5 (TFE:5:JRMfPVkrx8T) |
SentinelOne | Static AI - Suspicious PE |
MaxSecure | Trojan.Malware.101018141.susgen |
Fortinet | W32/Agent.HHI!tr.dldr |
BitDefenderTheta | Gen:NN.ZedlaF.36738.eu4@aukuV8ki |
AVG | Win32:RATX-gen [Trj] |
DeepInstinct | MALICIOUS |