Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6403_us | June 16, 2024, 9:53 a.m. | June 16, 2024, 9:55 a.m. |
Name | Response | Post-Analysis Lookup |
---|---|---|
No hosts contacted. |
IP Address | Status | Action |
---|---|---|
111.229.102.8 | Active | Moloch |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
packer | Armadillo v1.71 |
name | RT_ICON | language | LANG_CHINESE | filetype | GLS_BINARY_LSB_FIRST | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000b448 | size | 0x00000128 | ||||||||||||||||||
name | RT_ICON | language | LANG_CHINESE | filetype | GLS_BINARY_LSB_FIRST | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000b448 | size | 0x00000128 | ||||||||||||||||||
name | RT_DIALOG | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000b598 | size | 0x000001c6 | ||||||||||||||||||
name | RT_GROUP_ICON | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0000b570 | size | 0x00000022 |
file | C:\Users\test22\AppData\Local\Temp\27714954.dll |
cmdline | "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\test22\AppData\Local\Temp\999999.exe" |
cmdline | cmd.exe /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\test22\AppData\Local\Temp\999999.exe" |
file | C:\Users\test22\AppData\Local\Temp\999999.exe |
file | C:\Users\test22\AppData\Local\Temp\27714954.dll |
cmdline | "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\test22\AppData\Local\Temp\999999.exe" |
cmdline | cmd.exe /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\test22\AppData\Local\Temp\999999.exe" |
cmdline | ping 127.0.0.1 -n 1 |
host | 111.229.102.8 |
service_name | Simullatis | service_path | C:\Users\test22\AppData\Local\Temp\%SystemRoot%\System32\svchost.exe -k "Simullatis" | ||||||
reg_key | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Simullatis\Parameters\ServiceDll | reg_value | C:\Users\test22\AppData\Local\Temp\27714954.dll |
dead_host | 111.229.102.8:4577 |
Bkav | W32.AIDetectMalware |
Lionic | Trojan.Win32.YoungLotus.4!c |
Elastic | malicious (high confidence) |
Cynet | Malicious (score: 99) |
CAT-QuickHeal | Trojan.Younglotus.20397 |
Skyhigh | BackDoor-FCWQ!2B6BDD0A18E7 |
Cylance | Unsafe |
VIPRE | Gen:Heur.RI.1 |
Sangfor | Backdoor.Win32.Farfli.V63r |
K7AntiVirus | Trojan ( 0055e3e41 ) |
BitDefender | Gen:Heur.RI.1 |
K7GW | Trojan ( 0055e3e41 ) |
Cybereason | malicious.a18e76 |
Arcabit | Trojan.RI.1 |
VirIT | Backdoor.Win32.Generic.JUY |
Symantec | SMG.Heur!gen |
tehtris | Generic.Malware |
ESET-NOD32 | Win32/Farfli.BGW |
APEX | Malicious |
McAfee | BackDoor-FCWQ!2B6BDD0A18E7 |
Avast | Win32:DropperX-gen [Drp] |
ClamAV | Win.Dropper.Gh0stRAT-7073897-1 |
Kaspersky | Trojan.Win32.YoungLotus.t |
Alibaba | Backdoor:Win32/YoungLotus.e63479da |
NANO-Antivirus | Trojan.Win32.YoungLotus.dpanmc |
SUPERAntiSpyware | Trojan.Agent/Gen-Zusy |
MicroWorld-eScan | Gen:Heur.RI.1 |
Rising | Backdoor.Farfli!1.C639 (CLASSIC) |
Emsisoft | Gen:Heur.RI.1 (B) |
F-Secure | Trojan.TR/AD.Farfli.qqkhu |
DrWeb | Trojan.DownLoader12.47777 |
Zillya | Trojan.YoungLotus.Win32.4 |
TrendMicro | BKDR_ZEGOST.SM29 |
McAfeeD | ti!B6E1C130D2B9 |
Trapmine | malicious.moderate.ml.score |
FireEye | Generic.mg.2b6bdd0a18e76a5d |
Sophos | Mal/Generic-S |
Ikarus | Trojan.Win32.Farfli |
Jiangmin | Trojan/YoungLotus.e |
Webroot | Trojan.Younglotus |
Detected | |
Avira | TR/AD.Farfli.qqkhu |
MAX | malware (ai score=83) |
Antiy-AVL | Trojan/Win32.Farfli |
Kingsoft | malware.kb.a.993 |
Gridinsoft | Trojan.Win32.Gen.tr |
Xcitium | TrojWare.Win32.YoungLotus.TCM@5ruomd |
Microsoft | Backdoor:Win32/Venik!pz |
ZoneAlarm | Trojan.Win32.YoungLotus.t |
GData | Gen:Heur.RI.1 |