Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | June 16, 2024, 9:53 a.m. | June 16, 2024, 9:55 a.m. |
Name | Response | Post-Analysis Lookup |
---|---|---|
No hosts contacted. |
IP Address | Status | Action |
---|---|---|
8.138.116.47 | Active | Moloch |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
packer | Armadillo v1.71 |
name | RT_ICON | language | LANG_CHINESE | filetype | GLS_BINARY_LSB_FIRST | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000b448 | size | 0x00000128 | ||||||||||||||||||
name | RT_ICON | language | LANG_CHINESE | filetype | GLS_BINARY_LSB_FIRST | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000b448 | size | 0x00000128 | ||||||||||||||||||
name | RT_DIALOG | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000b598 | size | 0x000001c6 | ||||||||||||||||||
name | RT_GROUP_ICON | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000b570 | size | 0x00000022 |
file | C:\Users\test22\AppData\Local\Temp\20461485.dll |
cmdline | cmd.exe /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\test22\AppData\Local\Temp\8989.exe" |
cmdline | "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\test22\AppData\Local\Temp\8989.exe" |
file | C:\Users\test22\AppData\Local\Temp\8989.exe |
file | C:\Users\test22\AppData\Local\Temp\20461485.dll |
cmdline | cmd.exe /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\test22\AppData\Local\Temp\8989.exe" |
cmdline | "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\test22\AppData\Local\Temp\8989.exe" |
cmdline | ping 127.0.0.1 -n 1 |
host | 8.138.116.47 |
service_name | SRDSL | service_path | C:\Users\test22\AppData\Local\Temp\%SystemRoot%\System32\svchost.exe -k "SRDSL" | ||||||
reg_key | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SRDSL\Parameters\ServiceDll | reg_value | C:\Users\test22\AppData\Local\Temp\20461485.dll |
Bkav | W32.AIDetectMalware |
Lionic | Trojan.Win32.YoungLotus.4!c |
Elastic | malicious (high confidence) |
Cynet | Malicious (score: 99) |
CAT-QuickHeal | Trojan.Younglotus.20397 |
Skyhigh | BackDoor-FCWQ!7D8056785948 |
Cylance | Unsafe |
VIPRE | Gen:Heur.RI.1 |
Sangfor | Backdoor.Win32.Farfli.Vpkj |
K7AntiVirus | Trojan ( 0055e3e41 ) |
BitDefender | Gen:Heur.RI.1 |
K7GW | Trojan ( 0055e3e41 ) |
Cybereason | malicious.859482 |
Arcabit | Trojan.RI.1 |
VirIT | Backdoor.Win32.Generic.JUY |
Symantec | SMG.Heur!gen |
ESET-NOD32 | Win32/Farfli.BGW |
APEX | Malicious |
McAfee | BackDoor-FCWQ!7D8056785948 |
Avast | Win32:DropperX-gen [Drp] |
ClamAV | Win.Dropper.Gh0stRAT-7073897-1 |
Kaspersky | Trojan.Win32.YoungLotus.t |
Alibaba | Backdoor:Win32/YoungLotus.13c1f9fa |
NANO-Antivirus | Trojan.Win32.YoungLotus.dpanmc |
SUPERAntiSpyware | Trojan.Agent/Gen-Zusy |
MicroWorld-eScan | Gen:Heur.RI.1 |
Rising | Trojan.Farfli!1.C639 (KTSE) |
Emsisoft | Gen:Heur.RI.1 (B) |
F-Secure | Trojan.TR/AD.Farfli.qqkhu |
DrWeb | Trojan.DownLoader12.47777 |
Zillya | Trojan.YoungLotus.Win32.4 |
TrendMicro | BKDR_ZEGOST.SM29 |
McAfeeD | ti!F59D23FCB44D |
Trapmine | malicious.moderate.ml.score |
FireEye | Generic.mg.7d8056785948284e |
Sophos | Mal/Generic-S |
Ikarus | Win32.Outbreak |
Jiangmin | Trojan/YoungLotus.e |
Webroot | Trojan.Younglotus |
Detected | |
Avira | TR/AD.Farfli.qqkhu |
MAX | malware (ai score=83) |
Antiy-AVL | Trojan/Win32.Farfli |
Kingsoft | malware.kb.a.922 |
Gridinsoft | Trojan.Win32.Gen.tr |
Xcitium | TrojWare.Win32.YoungLotus.TCM@5ruomd |
Microsoft | Backdoor:Win32/Venik!pz |
ZoneAlarm | Trojan.Win32.YoungLotus.t |
GData | Gen:Heur.RI.1 |
Varist | W32/S-0f55ee81!Eldorado |
dead_host | 192.168.56.101:49171 |
dead_host | 192.168.56.101:49170 |
dead_host | 192.168.56.101:49169 |
dead_host | 8.138.116.47:8989 |
dead_host | 192.168.56.101:49168 |
dead_host | 192.168.56.101:49165 |
dead_host | 192.168.56.101:49166 |
dead_host | 192.168.56.101:49173 |
dead_host | 192.168.56.101:49172 |