Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 11, 2024, 7:26 p.m.	May 11, 2024, 7:28 p.m.

Size	819.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`983f094cf97faca11916d717b22b64ca`
SHA256	`230fb3ddc18793a3a520810ad7d76eb3629558c327c3c1f0418c5d930bca035b`
CRC32	`25840786`
ssdeep	`24576:JfnYNSoeuTPZAX/LZNVgJEEEEEEEEEEEEEEEEEEEE:JMu+EEEEEEEEEEEEEEEEEEEE`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature DllRegisterServer_Zero - execute regsvr32.exe IsPE32 - (no description) mzp_file_format - MZP(Delphi) file format UPX_Zero - UPX packed file

htm.exe "C:\Users\test22\AppData\Local\Temp\htm.exe"
2548

Name	Response	Post-Analysis Lookup
onedrive.live.com	CNAME odc-web-geo.onedrive.akadns.net CNAME odwebpl.trafficmanager.net.dual-spov-0006.spov-msedge.net CNAME dual-spov-0006.spov-msedge.net CNAME web.fe.1drv.com CNAME odc-web-brs.onedrive.akadns.net A 13.107.139.11 A 13.107.137.11	13.107.139.11

IP Address	Status	Action
13.107.139.11	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49164 -> 13.107.139.11:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

No Suricata TLS

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.itext

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 11, 2024, 7:26 p.m.	stacktrace: htm+0x5a76e @ 0x45a76e htm+0x442f @ 0x40442f htm+0x4497 @ 0x404497 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ed 81 fb 68 58 4d 56 75 07 c7 45 fc 01 00 00 00 exception.symbol: htm+0x5950a exception.instruction: in eax, dx exception.module: htm.exe exception.exception_code: 0xc0000096 exception.offset: 365834 exception.address: 0x45950a registers.esp: 1637124 registers.edi: 1638216 registers.eax: 1447909480 registers.ebp: 1637152 registers.edx: 22104 registers.ebx: 0 registers.esi: 4557478 registers.ecx: 10	1	0	0
__exception__ May 11, 2024, 7:26 p.m.	stacktrace: 0x34075fa 0x340762d 0x3407548 0x33fe408 0x341028d 0x3417cec DriverCallback+0x4e waveOutOpen-0xa2e winmm+0x3af0 @ 0x73933af0 timeEndPeriod+0x54a timeKillEvent-0x57 winmm+0xa535 @ 0x7393a535 timeEndPeriod+0x449 timeKillEvent-0x158 winmm+0xa434 @ 0x7393a434 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 755556992 registers.edi: 1 registers.eax: 755556992 registers.ebp: 755557072 registers.edx: 0 registers.ebx: 755558796 registers.esi: 37926576 registers.ecx: 7	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 86 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73662000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01d30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 1385447420 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b3604 process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 region_size: 700002304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x033f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:26 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0342e364 process_handle: 0xffffffff		3221225496

Disables proxy possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA May 11, 2024, 7:26 p.m.	key_handle: 0x000002d4 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	1	0	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 11, 2024, 7:26 p.m.	stacktrace: htm+0x5a76e @ 0x45a76e htm+0x442f @ 0x40442f htm+0x4497 @ 0x404497 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ed 81 fb 68 58 4d 56 75 07 c7 45 fc 01 00 00 00 exception.symbol: htm+0x5950a exception.instruction: in eax, dx exception.module: htm.exe exception.exception_code: 0xc0000096 exception.offset: 365834 exception.address: 0x45950a registers.esp: 1637124 registers.edi: 1638216 registers.eax: 1447909480 registers.ebp: 1637152 registers.edx: 22104 registers.ebx: 0 registers.esi: 4557478 registers.ecx: 10	1	0	0

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.ModiLoader.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 99)
CAT-QuickHeal	Trojan.Strab
Cylance	unsafe
VIPRE	Trojan.GenericKD.72698662
Sangfor	Downloader.Win32.Modiloader.Vmag
BitDefender	Trojan.GenericKD.72698662
Arcabit	Trojan.Generic.D4554B26
VirIT	Trojan.Win32.Dwnldr.DZA
Symantec	Trojan.Gen.MBT
ESET-NOD32	Win32/TrojanDownloader.ModiLoader.ACM
APEX	Malicious
Avast	Win32:RATX-gen [Trj]
Kaspersky	HEUR:Trojan.Win32.Strab.gen
MicroWorld-eScan	Trojan.GenericKD.72698662
Rising	Trojan.Generic@AI.94 (RDML:n/6o8xQkrMwjq3gtAMqHjA)
Emsisoft	Trojan.GenericKD.72698662 (B)
F-Secure	Trojan.TR/Redcap.cxvad
DrWeb	Trojan.DownLoader46.62650
TrendMicro	Backdoor.Win32.REMCOS.YXEEIZ
Trapmine	suspicious.low.ml.score
FireEye	Trojan.GenericKD.72698662
Sophos	Mal/Generic-S
Ikarus	Trojan-Spy.MetaStealer
Google	Detected
Avira	TR/Redcap.cxvad
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Win32.Modiloader
Kingsoft	malware.kb.a.986
Gridinsoft	Trojan.Win32.Remcos.tr
Microsoft	Trojan:Win32/Remcos.TAQ!MTB
ZoneAlarm	HEUR:Trojan.Win32.Strab.gen
GData	Trojan.GenericKD.72698662
Varist	W32/Agent.UUWW-8487
AhnLab-V3	Trojan/Win.RATX-gen.R647787
DeepInstinct	MALICIOUS
VBA32	BScope.Backdoor.RmRAT
Malwarebytes	Malware.AI.3968541537
TrendMicro-HouseCall	Backdoor.Win32.REMCOS.YXEEIZ
Tencent	Win32.Trojan.Strab.Ftgl
SentinelOne	Static AI - Suspicious PE
MaxSecure	Trojan.Malware.124015119.susgen
Fortinet	W32/ModiLoader.ABE!tr
AVG	Win32:RATX-gen [Trj]
Paloalto	generic.ml
alibabacloud	Trojan[downloader]:Win/ModiLoader.AWO

htm.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All