Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 27, 2024, 1:36 p.m.	Sept. 27, 2024, 1:46 p.m.

Size	15.8MB
Type	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5	`c994bb9982dd689598c6c261090a40cb`
SHA256	`fbce9fc010fdfb67da5ff95cc5a5d1dbb0c07950522f130b031e55831f81b060`
CRC32	`86EF4723`
ssdeep	`196608:rcRl1WLHnSCf24VHfaRpamWwSOsPlebA:8CLkGMadfNgb`
Yara	PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsDLL - (no description) DllRegisterServer_Zero - execute regsvr32.exe IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\payload.dll,DllRegisterServer
2132
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\payload.dll,DllInstall
1884
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\payload.dll,DllUnregisterServer
2224
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\payload.dll,StartW
2316
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\payload.dll,VoidFunc
2416
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\payload.dll,_cgo_dummy_export
2508
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\payload.dll,
2596

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
203.204.217.190	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49178 -> 203.204.217.190:8092	2260000	SURICATA Applayer Mismatch protocol both directions	Generic Protocol Command Decode
TCP 203.204.217.190:8092 -> 192.168.56.103:49179	2260000	SURICATA Applayer Mismatch protocol both directions	Generic Protocol Command Decode
TCP 203.204.217.190:8092 -> 192.168.56.103:49175	2260000	SURICATA Applayer Mismatch protocol both directions	Generic Protocol Command Decode
TCP 203.204.217.190:8092 -> 192.168.56.103:49177	2260000	SURICATA Applayer Mismatch protocol both directions	Generic Protocol Command Decode
TCP 203.204.217.190:8092 -> 192.168.56.103:49176	2260000	SURICATA Applayer Mismatch protocol both directions	Generic Protocol Command Decode

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (11 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 27, 2024, 1:36 p.m.			0	0
IsDebuggerPresent Sept. 27, 2024, 1:36 p.m.			0	0
IsDebuggerPresent Sept. 27, 2024, 1:36 p.m.			0	0
IsDebuggerPresent Sept. 27, 2024, 1:36 p.m.			0	0
IsDebuggerPresent Sept. 27, 2024, 1:36 p.m.			0	0
IsDebuggerPresent Sept. 27, 2024, 1:36 p.m.			0	0
IsDebuggerPresent Sept. 27, 2024, 1:36 p.m.			0	0
IsDebuggerPresent Sept. 27, 2024, 1:36 p.m.			0	0
IsDebuggerPresent Sept. 27, 2024, 1:36 p.m.			0	0
IsDebuggerPresent Sept. 27, 2024, 1:36 p.m.			0	0
IsDebuggerPresent Sept. 27, 2024, 1:36 p.m.			0	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 27, 2024, 1:36 p.m.	stacktrace: rundll32+0x1326 @ 0xda1326 rundll32+0x1901 @ 0xda1901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.instruction: add byte ptr [eax], al exception.exception_code: 0xc0000005 exception.symbol: DllUnregisterServer+0x5eff2c payload+0xfc510c exception.address: 0x7352510c registers.esp: 2815544 registers.edi: 0 registers.eax: 65898 registers.ebp: 2815660 registers.edx: 9 registers.ebx: 0 registers.esi: 65898 registers.ecx: 0	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 71 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73527000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744a0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74451000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74431000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x758f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76bd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x756f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74351000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:37 p.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74051000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73527000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744a0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74451000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x758f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76bd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x756f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74431000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74351000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:37 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74051000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73527000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744a0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74451000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x758f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76bd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x756f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74431000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74351000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:37 p.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74051000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73527000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744a0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74451000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x758f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76bd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x756f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74431000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74351000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:37 p.m.	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74051000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73527000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 27, 2024, 1:36 p.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744a0000 process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 27, 2024, 1:37 p.m.	flags: 15 family: 0		111	0

Communicates with host for which no DNS query was performed (1 event)

host

203.204.217.190

Detects the presence of Wine emulator (6 events)

Time & API	Arguments	Return
LdrGetProcedureAddress Sept. 27, 2024, 1:36 p.m.	ordinal: 0 function_address: 0x009cf7b9 function_name: wine_get_version module: ntdll module_address: 0x778a0000	3221225785
LdrGetProcedureAddress Sept. 27, 2024, 1:36 p.m.	ordinal: 0 function_address: 0x004af789 function_name: wine_get_version module: ntdll module_address: 0x778a0000	3221225785
LdrGetProcedureAddress Sept. 27, 2024, 1:36 p.m.	ordinal: 0 function_address: 0x009dfb59 function_name: wine_get_version module: ntdll module_address: 0x778a0000	3221225785
LdrGetProcedureAddress Sept. 27, 2024, 1:36 p.m.	ordinal: 0 function_address: 0x00a5f959 function_name: wine_get_version module: ntdll module_address: 0x778a0000	3221225785
LdrGetProcedureAddress Sept. 27, 2024, 1:36 p.m.	ordinal: 0 function_address: 0x003afb69 function_name: wine_get_version module: ntdll module_address: 0x778a0000	3221225785
LdrGetProcedureAddress Sept. 27, 2024, 1:36 p.m.	ordinal: 0 function_address: 0x00b0fc59 function_name: wine_get_version module: ntdll module_address: 0x778a0000	3221225785

File has been identified by 26 AntiVirus engines on VirusTotal as malicious (26 events)

Bkav	W32.AIDetectMalware
ALYac	Dump:Generic.Sliver.Marte.C.F199BDC5
VIPRE	Dump:Generic.Sliver.Marte.C.F199BDC5
Sangfor	HackTool.Win32.Sliver_Implant_64bit.uwccg
BitDefender	Dump:Generic.Sliver.Marte.C.F199BDC5
Arcabit	Dump:Generic.Sliver.Marte.C.F199BDC5
Elastic	Multi.Trojan.Sliver
ESET-NOD32	a variant of WinGo/HackTool.Sliver.N
Avast	MalwareX-gen [Trj]
ClamAV	Win.File.Sliver-9942542-0
Kaspersky	HEUR:HackTool.Win64.Vilers.gen
MicroWorld-eScan	Dump:Generic.Sliver.Marte.C.F199BDC5
Emsisoft	Dump:Generic.Sliver.Marte.C.F199BDC5 (B)
F-Secure	Hack-Tool:W32/SBeacon.A
CTX	dll.unknown.dump
SentinelOne	Static AI - Malicious PE
FireEye	Dump:Generic.Sliver.Marte.C.F199BDC5
Google	Detected
Kingsoft	Win64.HackTool.Vilers.gen
Microsoft	Trojan:Win32/SuspGolang.AG
ZoneAlarm	HEUR:HackTool.Win64.Vilers.gen
GData	Win64.Malware.Sliver.5VSUHL
Ikarus	Trojan.Crypt
Tencent	Win64.Hacktool.Vilers.Yfow
huorong	HEUR:HackTool/Sliver.a
AVG	MalwareX-gen [Trj]

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (6 events)

dead_host	192.168.56.103:49171
dead_host	192.168.56.103:49170
dead_host	203.204.217.190:8082
dead_host	192.168.56.103:49169
dead_host	192.168.56.103:49167
dead_host	192.168.56.103:49168

payload.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All