Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 19, 2024, 9:33 a.m.	June 19, 2024, 9:42 a.m.

Size	835.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`a41dcc178717a13af8972680faa8e697`
SHA256	`7b8d1f3d477e0a2dfdf4ebe4908e85d4762b8c77cff787801f27580867dc16cd`
CRC32	`40F95D36`
ssdeep	`24576:T+e/lcKH8igT+7O1Okjia6AOYP1i7RSzMdND5X:T+e/GcxgT+4ilAOHRD1`
Yara	PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

3.exe "C:\Users\test22\AppData\Local\Temp\3.exe"
508

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
80.76.49.148	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 80.76.49.148:7702 -> 192.168.56.103:49162	2400008	ET DROP Spamhaus DROP Listed Traffic Inbound group 9	Misc Attack

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 19, 2024, 9:33 a.m.			0	0
IsDebuggerPresent June 19, 2024, 9:33 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (5 events)

Time & API	Arguments	Status	Return
CryptExportKey June 19, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000054bd00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 8	1	1
CryptExportKey June 19, 2024, 9:34 a.m.	buffer: f ìIÌÓèìYþÌ,D àôDÅü0Ô54m crypto_handle: 0x000000000054bd00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 8	1	1
CryptExportKey June 19, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000054c0f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000054c0f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey June 19, 2024, 9:34 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000054c0f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 19, 2024, 9:33 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 123 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000780000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000860000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3c6b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000e30000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000fa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35d4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93efc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f26000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:33 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e5c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:34 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e6b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:34 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:34 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e9c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:34 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e6d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:34 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:34 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e5a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:34 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e42000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:34 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e5d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:34 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e5e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:34 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e5f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:34 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:34 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fd1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:34 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fd2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:34 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fd3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:34 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fd4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:34 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fd5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:34 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fd6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 19, 2024, 9:34 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fd7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000d0400', u'virtual_address': u'0x00002000', u'entropy': 7.999194795606147, u'name': u'.text', u'virtual_size': u'0x000d0268'}

entropy

7.99919479561

description

A section with a high entropy has been found

entropy

0.997604790419

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

80.76.49.148

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.NanoBot.m!c
Elastic	malicious (high confidence)
Skyhigh	BehavesLike.Win32.Generic.cc
ALYac	Gen:Variant.Jalapeno.12513
Cylance	Unsafe
VIPRE	Gen:Variant.Jalapeno.12513
Sangfor	Trojan.Win32.Save.a
BitDefender	Gen:Variant.Jalapeno.12513
Cybereason	malicious.78717a
Arcabit	Trojan.Jalapeno.D30E1
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.ALFN
APEX	Malicious
McAfee	Artemis!A41DCC178717
Avast	Win32:CrypterX-gen [Trj]
Kaspersky	HEUR:Backdoor.MSIL.NanoBot.gen
MicroWorld-eScan	Gen:Variant.Jalapeno.12513
Rising	Malware.Obfus/MSIL@AI.89 (RDM.MSIL2:PKZJPMR6j3H7DAOzoZ8hYQ)
Emsisoft	Gen:Variant.Jalapeno.12513 (B)
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.PWS.Siggen3.37585
TrendMicro	TROJ_GEN.R014C0DFI24
McAfeeD	Real Protect-LS!A41DCC178717
FireEye	Generic.mg.a41dcc178717a13a
Sophos	Mal/Generic-S
Ikarus	Win32.Outbreak
Avira	TR/Dropper.Gen
MAX	malware (ai score=81)
Kingsoft	MSIL.Backdoor.NanoBot.gen
Gridinsoft	Trojan.Win32.Kryptik.sa
Microsoft	Trojan:MSIL/PureLogStealer.PCAA!MTB
ZoneAlarm	HEUR:Backdoor.MSIL.NanoBot.gen
GData	Gen:Variant.Jalapeno.12513
AhnLab-V3	Trojan/Win.Generic.C5630360
BitDefenderTheta	Gen:NN.ZemsilF.36806.0m0@aSm3yyj
DeepInstinct	MALICIOUS
Malwarebytes	MachineLearning/Anomalous.100%
Panda	Trj/GdSda.A
Tencent	Msil.Backdoor.Nanobot.Ytjl
SentinelOne	Static AI - Malicious PE
MaxSecure	Win.MxResIcn.Heur.Gen
Fortinet	MSIL/Kryptik.ALFN!tr
AVG	Win32:CrypterX-gen [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (W)
alibabacloud	Backdoor:MSIL/PureLogStealer.PWZO3DGW

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 events)

dead_host	192.168.56.103:49162
dead_host	80.76.49.148:7702

3.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All