Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6403_us | July 8, 2024, 4:47 p.m. | July 8, 2024, 4:51 p.m. |
-
-
whoami.exe whoami
2256
-
Name | Response | Post-Analysis Lookup |
---|---|---|
source-update.hugratcat.top | 172.67.133.143 |
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
UDP 192.168.56.103:50800 -> 164.124.101.2:53 | 2023883 | ET DNS Query to a *.top domain - Likely Hostile | Potentially Bad Traffic |
TCP 192.168.56.103:49162 -> 172.67.133.143:2095 | 2023882 | ET INFO HTTP Request to a *.top domain | Potentially Bad Traffic |
Suricata TLS
No Suricata TLS
domain | source-update.hugratcat.top | description | Generic top level domain TLD |
section | {u'size_of_data': u'0x005a9e00', u'virtual_address': u'0x00a7a000', u'entropy': 7.8918429643576005, u'name': u'UPX1', u'virtual_size': u'0x005aa000'} | entropy | 7.89184296436 | description | A section with a high entropy has been found | |||||||||
entropy | 0.999913793103 | description | Overall entropy of this PE file is high |
section | UPX0 | description | Section name indicates UPX | ||||||
section | UPX1 | description | Section name indicates UPX | ||||||
section | UPX2 | description | Section name indicates UPX |
cmdline | whoami |
host | 39.97.52.57 |
Bkav | W64.AIDetectMalware |
Elastic | malicious (moderate confidence) |
Cynet | Malicious (score: 100) |
Skyhigh | BehavesLike.Win64.Generic.tc |
Cylance | Unsafe |
Sangfor | Trojan.Win32.Save.a |
Symantec | ML.Attribute.HighConfidence |
ESET-NOD32 | a variant of WinGo/Kryptik.FF |
APEX | Malicious |
Kaspersky | VHO:Trojan.Win32.Eb.gen |
McAfeeD | ti!A6B3C627DAA3 |
Sophos | CXrep/MalGo-B |
Ikarus | Trojan.WinGo.Injector |
Detected | |
Antiy-AVL | GrayWare/Win32.Kryptik.ffp |
ZoneAlarm | VHO:Trojan.Win32.Eb.gen |
Varist | W64/Agent.FXW.gen!Eldorado |
Malwarebytes | Malware.AI.2899897670 |
MaxSecure | Trojan.Malware.300983.susgen |