NewApp.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6403_us | Dec. 31, 2024, 1:22 p.m. | Dec. 31, 2024, 1:26 p.m. |
-
NewApp.exe "C:\Users\test22\AppData\Local\Temp\NewApp.exe"
2056
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| xmr-eu1.nanopool.org | 51.15.58.224 | |
| rentry.org | 164.132.58.105 | |
| pastebin.com | 104.20.3.235 |
| IP Address | Status | Action |
|---|---|---|
| 164.124.101.2 | Active | Moloch |
Suricata Alerts
Suricata TLS
No Suricata TLS
| section | .00cfg |
| section | .vmp@\xe2\xa2\xaf |
| resource name | FLEXDL |
| resource name | FX |
| resource name | MUI |
| resource name | REGISTRY |
| resource name | TXT |
| resource name | XMLWRITE |
| resource name | None |
| section | {u'size_of_data': u'0x0057ba00', u'virtual_address': u'0x005ae000', u'entropy': 7.9815832639998705, u'name': u'.vmp@\\xe2\\xa2\\xaf', u'virtual_size': u'0x0057b944'} | entropy | 7.981583264 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.995920177384 | description | Overall entropy of this PE file is high | |||||||||||
| section | .vmp@\xe2\xa2\xaf | description | Section name indicates VMProtect | ||||||
| section | .vmp@\xe2\xa2\xaf | description | Section name indicates VMProtect | ||||||
| section | .vmp@\xe2\xa2\xaf | description | Section name indicates VMProtect | ||||||
| Bkav | W64.AIDetectMalware |
| Lionic | Trojan.Win32.Agent.Y!c |
| Cynet | Malicious (score: 100) |
| Skyhigh | Artemis!Trojan |
| ALYac | Trojan.GenericKD.75271981 |
| Cylance | Unsafe |
| VIPRE | Trojan.GenericKD.75271981 |
| Sangfor | Trojan.Win32.Agent.Vumi |
| CrowdStrike | win/malicious_confidence_90% (W) |
| BitDefender | Trojan.GenericKD.75271981 |
| Arcabit | Trojan.Generic.D47C8F2D |
| Symantec | ML.Attribute.HighConfidence |
| Elastic | malicious (high confidence) |
| ESET-NOD32 | a variant of Generik.FOJBYDI |
| Avast | Win64:TrojanX-gen [Trj] |
| Kaspersky | Trojan.Win32.Agent.xbuzse |
| MicroWorld-eScan | Trojan.GenericKD.75271981 |
| Rising | Trojan.Reflo!8.1230F (TFE:5:4KEnqrPNWbT) |
| Emsisoft | Trojan.GenericKD.75271981 (B) |
| F-Secure | Trojan.TR/AD.Nekark.isecy |
| DrWeb | Trojan.Siggen30.39968 |
| McAfeeD | ti!C9D6EBDFF127 |
| CTX | exe.trojan.generic |
| Sophos | Mal/Generic-S |
| SentinelOne | Static AI - Suspicious PE |
| FireEye | Generic.mg.5d1255087c4512f2 |
| Detected | |
| Avira | TR/AD.Nekark.isecy |
| Antiy-AVL | Trojan/Win32.Caynamer |
| Kingsoft | Win32.Trojan.Agent.xbuzse |
| Gridinsoft | Trojan.Heur!.00210203 |
| Microsoft | Trojan:Win32/Caynamer.A!ml |
| GData | Trojan.GenericKD.75271981 |
| Varist | W64/ABRisk.YMWR-4215 |
| McAfee | Artemis!5D1255087C45 |
| DeepInstinct | MALICIOUS |
| MaxSecure | Trojan.Malware.300983.susgen |
| Fortinet | W32/PossibleThreat |
| AVG | Win64:TrojanX-gen [Trj] |
| Paloalto | generic.ml |