Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6403_us | Sept. 17, 2024, 1:21 p.m. | Sept. 17, 2024, 1:28 p.m. |
-
cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "zUUf" C:\Users\test22\AppData\Local\Temp\debug.dbg
940-
rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\test22\AppData\Local\Temp\debug.dbg
2184-
editplus.exe "editplus.exe"
2684
-
-
-
explorer.exe C:\Windows\Explorer.EXE
1236
Name | Response | Post-Analysis Lookup |
---|---|---|
No hosts contacted. |
IP Address | Status | Action |
---|---|---|
164.124.101.2 | Active | Moloch |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
file | C:\Program Files (x86)\Google\Chrome\Application\chrome.exe |
file | c:\program files\mozilla firefox\firefox.exe |
file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk |
file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EditPlus.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk |
file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk |
file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Chrome.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk |
file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk |
file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk |
file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\Word 2013.lnk |
file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk |
file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\displayswitch.lnk |
file | C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk |
file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk |
description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
description | (no description) | rule | DebuggerHiding__Thread | ||||||
description | (no description) | rule | DebuggerHiding__Active | ||||||
description | (no description) | rule | ThreadControl__Context | ||||||
description | (no description) | rule | SEH__vectored | ||||||
description | Checks if being debugged | rule | anti_dbg | ||||||
description | Bypass DEP | rule | disable_dep |
registry | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\EDITPLUS.EXE |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Mozilla Thunderbird\Capabilities\Hidden |
Lionic | Trojan.Linux.Mirai.K!c |
Cynet | Malicious (score: 99) |
CTX | elf.trojan.mirai |
ALYac | Trojan.Linux.Mirai.1 |
VIPRE | Trojan.Linux.Mirai.1 |
Sangfor | Suspicious.Linux.Save.a |
Arcabit | Trojan.Linux.Mirai.1 |
Symantec | Linux.Mirai |
Elastic | Linux.Trojan.Gafgyt |
ESET-NOD32 | a variant of Linux/Mirai.CIB |
TrendMicro-HouseCall | TROJ_GEN.R002C0DIF24 |
Avast | ELF:Mirai-AAP [Trj] |
ClamAV | Unix.Trojan.Mirai-9441505-0 |
Kaspersky | HEUR:Backdoor.Linux.Mirai.cw |
BitDefender | Trojan.Linux.Mirai.1 |
MicroWorld-eScan | Trojan.Linux.Mirai.1 |
Rising | Backdoor.Mirai/Linux!1.E332 (CLASSIC) |
Emsisoft | Trojan.Linux.Mirai.1 (B) |
F-Secure | Exploit.EXP/ELF.Mirai.Z.A |
DrWeb | Linux.Siggen.9999 |
TrendMicro | TROJ_GEN.R002C0DIF24 |
Sophos | Mal/Generic-S |
SentinelOne | Static AI - Malicious ELF |
FireEye | Trojan.Linux.Mirai.1 |
Jiangmin | Backdoor.Linux.jbfn |
Detected | |
Avira | EXP/ELF.Mirai.Z.A |
Antiy-AVL | Trojan[Backdoor]/Linux.Mirai.cw |
Kingsoft | Linux.Backdoor.Mirai.cw |
Microsoft | Backdoor:Linux/Gafgyt.AZ!xp |
ZoneAlarm | HEUR:Backdoor.Linux.Mirai.cw |
Avast-Mobile | ELF:Mirai-CKT [Trj] |
GData | Trojan.Linux.Mirai.1 |
Varist | E32/Mirai.EH.gen!Camelot |
Ikarus | Trojan.Linux.Mirai |
Tencent | Backdoor.Linux.Mirai.wan |
huorong | Backdoor/Linux.Mirai.dh |
MaxSecure | Trojan.Malware.121218.susgen |
Fortinet | ELF/Mirai.AT!tr |
AVG | ELF:Mirai-AAP [Trj] |
alibabacloud | DDOS:Linux/Mirai.ce8e7158 |