HomepageReverse.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6403_us | Jan. 2, 2024, 7:37 a.m. | Jan. 2, 2024, 7:47 a.m. |
-
-
-
-
findstr.exe findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
2332 -
tasklist.exe tasklist
2296 -
tasklist.exe tasklist
2444 -
findstr.exe findstr /I "wrsa.exe"
2480 -
cmd.exe cmd /c mkdir 20701
2552 -
cmd.exe cmd /c copy /b Democrat + Entitled + Garage + Nintendo + Aka 20701\Receptors.pif
2596 -
cmd.exe cmd /c copy /b Textbooks + Leader + Print 20701\p
2640 -
Receptors.pif 20701\Receptors.pif 20701\p
2684 -
PING.EXE ping -n 5 localhost
2756
-
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| hUbDLxwHbtXNnaaxVEnnFg.hUbDLxwHbtXNnaaxVEnnFg |
Suricata Alerts
No Suricata Alerts
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLS 1.2 192.168.56.103:49176 91.92.240.171:2469 |
C=XX, ST=N/A, L=N/A, O=Self-signed certificate, CN=91.92.240.171: Self-signed certificate | C=XX, ST=N/A, L=N/A, O=Self-signed certificate, CN=91.92.240.171: Self-signed certificate | b8:44:f4:1c:5f:52:72:c6:9c:b1:1b:6a:87:10:cd:95:89:94:8a:df |
|
TLS 1.2 192.168.56.103:49178 91.92.240.171:2469 |
C=XX, ST=N/A, L=N/A, O=Self-signed certificate, CN=91.92.240.171: Self-signed certificate | C=XX, ST=N/A, L=N/A, O=Self-signed certificate, CN=91.92.240.171: Self-signed certificate | b8:44:f4:1c:5f:52:72:c6:9c:b1:1b:6a:87:10:cd:95:89:94:8a:df |
|
TLS 1.2 192.168.56.103:49179 91.92.240.171:443 |
C=XX, ST=N/A, L=N/A, O=Self-signed certificate, CN=91.92.240.171: Self-signed certificate | C=XX, ST=N/A, L=N/A, O=Self-signed certificate, CN=91.92.240.171: Self-signed certificate | b8:44:f4:1c:5f:52:72:c6:9c:b1:1b:6a:87:10:cd:95:89:94:8a:df |
|
TLS 1.2 192.168.56.103:49177 91.92.240.171:2469 |
C=XX, ST=N/A, L=N/A, O=Self-signed certificate, CN=91.92.240.171: Self-signed certificate | C=XX, ST=N/A, L=N/A, O=Self-signed certificate, CN=91.92.240.171: Self-signed certificate | b8:44:f4:1c:5f:52:72:c6:9c:b1:1b:6a:87:10:cd:95:89:94:8a:df |
| file | C:\Users\test22\AppData\Local\Temp\15598\20701\Receptors.pif |
| file | C:\Users\test22\AppData\Local\Temp\15598\20701\Receptors.pif |
| file | C:\Users\test22\AppData\Local\Temp\15598\Democrat |
| file | C:\Users\test22\AppData\Local\Temp\15598\20701\Receptors.pif |
| wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process |
| section | {u'size_of_data': u'0x00068400', u'virtual_address': u'0x000f6000', u'entropy': 7.92971741972278, u'name': u'UPX1', u'virtual_size': u'0x00069000'} | entropy | 7.92971741972 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.803468208092 | description | Overall entropy of this PE file is high | |||||||||||
| process | receptors.pif |
| process | cmd.exe |
| url | http://www.microsoft.com/schemas/ie8tldlistdescription/1.0 |
| url | http://purl.org/rss/1.0/ |
| url | http://www.passport.com |
| description | Create a windows service | rule | Create_Service | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
| description | Hijack network configuration | rule | Hijack_Network | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerCheck__RemoteAPI | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | DebuggerException__ConsoleCtrl | ||||||
| description | (no description) | rule | DebuggerException__SetConsoleCtrl | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | (no description) | rule | Check_Dlls | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Anti-Sandbox checks for ThreatExpert | rule | antisb_threatExpert | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Affect hook table | rule | win_hook | ||||||
| description | File Downloader | rule | Network_Downloader | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Install itself for autorun at Windows startup | rule | Persistence | ||||||
| description | Communications over FTP | rule | Network_FTP | ||||||
| description | Run a KeyLogger | rule | KeyLogger | ||||||
| description | Communications over P2P network | rule | Network_P2P_Win | ||||||
| section | UPX0 | description | Section name indicates UPX | ||||||
| section | UPX1 | description | Section name indicates UPX | ||||||
| cmdline | cmd /c mkdir 20701 |
| cmdline | tasklist |
| cmdline | cmd /c copy /b Democrat + Entitled + Garage + Nintendo + Aka 20701\Receptors.pif |
| cmdline | ping -n 5 localhost |
| buffer | Buffer with sha1: 80905196bba682cc6b55ee4618888bdf8594b3ad |
| host | 91.92.240.171 | |||
| Lionic | Trojan.Win32.Agent.Y!c |
| tehtris | Generic.Malware |
| MicroWorld-eScan | Trojan.GenericKD.71043016 |
| FireEye | Generic.mg.be8cdde4842fd762 |
| Malwarebytes | Generic.Malware/Suspicious |
| VIPRE | Trojan.GenericKD.71043016 |
| Sangfor | Trojan.Win32.Save.a |
| CrowdStrike | win/malicious_confidence_90% (W) |
| Symantec | ML.Attribute.HighConfidence |
| Elastic | malicious (moderate confidence) |
| ESET-NOD32 | Win32/TrojanDropper.Delf.ACT |
| Kaspersky | Backdoor.Win32.Agent.myuthb |
| BitDefender | Trojan.GenericKD.71043016 |
| Tencent | Win32.Backdoor.Agent.Hajl |
| DrWeb | Trojan.Siggen22.62312 |
| TrendMicro | Trojan.Win32.PRIVATELOADER.YXEAAZ |
| Sophos | Mal/Generic-S |
| Webroot | W32.Infostealer.Gen |
| MAX | malware (ai score=80) |
| Antiy-AVL | Trojan/Win32.Sabsik |
| Kingsoft | Win32.Hack.Agent.a |
| Gridinsoft | Malware.Win32.Gen.tr |
| Arcabit | Trojan.Generic.D43C07C8 |
| ZoneAlarm | Backdoor.Win32.Agent.myuthb |
| GData | Trojan.GenericKD.71043016 |
| VBA32 | BScope.TrojanRansom.Blocker |
| Cylance | unsafe |
| Panda | Trj/Chgt.AD |
| TrendMicro-HouseCall | Trojan.Win32.PRIVATELOADER.YXEAAZ |
| Rising | Backdoor.Agent!8.C5D (CLOUD) |
| Fortinet | W32/PossibleThreat |
| DeepInstinct | MALICIOUS |