Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x3201	March 21, 2021, 10:29 a.m.	March 21, 2021, 10:31 a.m.

Size	546.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`955a8fad4b34c808afa21c1c8692891d`
SHA256	`cf9e8f0273d8a0272e20d362171bade0737e2c98b59d5c60af5070a9bcaa74b8`
CRC32	`ADA689C4`
ssdeep	`12288:sQOIVKgB7z01G3yfoQ0ANqxy9Fx/C3meRdksUQ:m9W08u0x8x/C35/ks`
Yara	PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero Win_Trojan_Trickbot_Zero - Used Trickbot win_files_operation - Affect private profile IsPE32 - (no description) IsDLL - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check HasRichSignature - Rich Signature Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\ADMINI~1\AppData\Local\Temp\mon93_cr.dll,DllRegisterServer1
7956
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\ADMINI~1\AppData\Local\Temp\mon93_cr.dll,
5864

Name	Response	Post-Analysis Lookup
150.134.208.175.b.barracudacentral.org	A 127.0.0.2	127.0.0.2
150.134.208.175.zen.spamhaus.org
api.ip.sb	CNAME api.ip.sb.cdn.cloudflare.net A 104.26.13.31 A 104.26.12.31 A 172.67.75.172	104.26.12.31
150.134.208.175.cbl.abuseat.org

IP Address	Status	Action
122.2.28.70	Active	Moloch
154.126.176.30	Active	Moloch
164.124.101.2	Active	Moloch
172.67.75.172	Active	Moloch
50.197.243.125	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49601 -> 172.67.75.172:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49600 -> 122.2.28.70:449	2404303	ET CNC Feodo Tracker Reported CnC Server group 4	A Network Trojan was detected
TCP 192.168.56.103:49600 -> 122.2.28.70:449	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 122.2.28.70:449 -> 192.168.56.103:49600	2011540	ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)	Not Suspicious Traffic
TCP 192.168.56.103:49602 -> 50.197.243.125:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 50.197.243.125:443 -> 192.168.56.103:49602	2011540	ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)	Not Suspicious Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49601 172.67.75.172:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	5e:7d:19:2d:d7:66:0c:63:45:a5:24:8f:b7:db:35:a7:61:6d:89:0e
TLSv1 192.168.56.103:49600 122.2.28.70:449	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	50:fd:fd:4e:2c:57:ea:f7:c9:cd:3f:61:4a:a2:40:01:1b:b8:df:02
TLSv1 192.168.56.103:49602 50.197.243.125:443	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	50:fd:fd:4e:2c:57:ea:f7:c9:cd:3f:61:4a:a2:40:01:1b:b8:df:02

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW March 21, 2021, 10:29 a.m.	computer_name: WIN7-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 21, 2021, 10:29 a.m.			0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (4 events)

suspicious_features	Connection to IP address	suspicious_request	GET https://50.197.243.125/mon93/WIN7-PC_W617601.93BB8C7511407F8371B563BB303FD36E/5/file/
suspicious_features	Connection to IP address	suspicious_request	GET https://50.197.243.125/mon93/WIN7-PC_W617601.93BB8C7511407F8371B563BB303FD36E/0/Windows%207%20x86%20SP1/1104/175.208.134.150/ED782E1E76A5CFB3B034E9323D902B376EF3D8927E4791D1434418F530E078D4/Xl03ixmBSrmV6KzqluzG/
suspicious_features	Connection to IP address	suspicious_request	GET https://50.197.243.125/mon93/WIN7-PC_W617601.93BB8C7511407F8371B563BB303FD36E/14/user/Administrator/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://50.197.243.125/mon93/WIN7-PC_W617601.93BB8C7511407F8371B563BB303FD36E/14/DNSBL/listed/0/

Performs some HTTP requests (5 events)

request	GET https://api.ip.sb/ip
request	GET https://50.197.243.125/mon93/WIN7-PC_W617601.93BB8C7511407F8371B563BB303FD36E/5/file/
request	GET https://50.197.243.125/mon93/WIN7-PC_W617601.93BB8C7511407F8371B563BB303FD36E/0/Windows%207%20x86%20SP1/1104/175.208.134.150/ED782E1E76A5CFB3B034E9323D902B376EF3D8927E4791D1434418F530E078D4/Xl03ixmBSrmV6KzqluzG/
request	GET https://50.197.243.125/mon93/WIN7-PC_W617601.93BB8C7511407F8371B563BB303FD36E/14/user/Administrator/0/
request	GET https://50.197.243.125/mon93/WIN7-PC_W617601.93BB8C7511407F8371B563BB303FD36E/14/DNSBL/listed/0/

Allocates read-write-execute memory (usually to unpack itself) (35 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c149000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74841000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72321000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778e1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x77631000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x724b1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x721a4000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72322000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74551000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 region_size: 225280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01a90000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 region_size: 274432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01de0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 region_size: 135168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 region_size: 139264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 region_size: 139264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 region_size: 122880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e8f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e91000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01af0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x77681000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75791000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75771000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71f11000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71e91000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e21000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75c61000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75661000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75301000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75661000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75341000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75621000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71e71000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x754e1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75471000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 21, 2021, 10:29 a.m.	process_identifier: 7956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1	0

A process attempted to delay the analysis task. (1 event)

description

rundll32.exe tried to sleep 321 seconds, actually delayed analysis time by 321 seconds

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses March 21, 2021, 10:29 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW March 21, 2021, 10:29 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (15 events)

url	http://www.iec.ch
url	http://activex.microsoft.com/controls/microsoft_only/ticker.cab
url	http://www.microsoft.com/library/images/gifs/ticker/f
url	http://localizability/practices/XMLConfiguration.asp
url	http://purl.org/dc/elements/1.1/
url	http://www.microsoft.com/money
url	http://ns.adobe.com/photoshop/1.0/
url	http://localizability/practices/XML.asp
url	http://www.microsoft.com/library/images/gifs/ticker/white.bmp
url	http://ns.adobe.com/xap/1.0/sType/ResourceRef
url	http://www.msnbc.com/news/ticker.txt
url	http://ns.adobe.com/exif/1.0/
url	http://ns.adobe.com/tiff/1.0/
url	http://ns.adobe.com/xap/1.0/
url	http://ns.adobe.com/xap/1.0/mm/

Yara rule detected in process memory (43 events)

description	Code injection with CreateRemoteThread in a remote process	rule	inject_thread
description	Create a windows service	rule	create_service
description	Create a COM server	rule	create_com_service
description	Communications over UDP network	rule	network_udp_sock
description	Listen for incoming communication	rule	network_tcp_listen
description	Communications over P2P network	rule	network_p2p_win
description	Communications over HTTP	rule	network_http
description	File downloader/dropper	rule	network_dropper
description	Communications over FTP	rule	network_ftp
description	Communications over RAW socket	rule	network_tcp_socket
description	Communications use DNS	rule	network_dns
description	Communication using dga	rule	network_dga
description	Escalade priviledges	rule	escalate_priv
description	Take screenshot	rule	screenshot
description	Run a keylogger	rule	keylogger
description	Steal credential	rule	cred_local
description	Record Audio	rule	sniff_audio
description	APC queue tasks migration	rule	migrate_apc
description	Malware can spread east-west file	rule	spreading_file
description	Malware can spread east-west using share drive	rule	spreading_share
description	Create or check mutex	rule	win_mutex
description	Affect system registries	rule	win_registry
description	Affect system token	rule	win_token
description	Affect private profile	rule	win_private_profile
description	Affect private profile	rule	win_files_operation
description	Match Winsock 2 API library declaration	rule	Str_Win32_Winsock2_Library
description	Match Windows Inet API library declaration	rule	Str_Win32_Wininet_Library
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook

Communicates with host for which no DNS query was performed (3 events)

host	122.2.28.70
host	154.126.176.30
host	50.197.243.125

File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 events)

MicroWorld-eScan	Gen:Variant.Zusy.369700
ALYac	Gen:Variant.Zusy.369700
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Trojan ( 0057894c1 )
Alibaba	Trojan:Win32/Kryptik.6680c563
K7GW	Trojan ( 0057894c1 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Zusy.D5A424
BitDefenderTheta	Gen:NN.ZedlaF.34628.Iq4@aaYoZRc
Symantec	Trojan.Gen.2
APEX	Malicious
Avast	Win32:BankerX-gen [Trj]
Kaspersky	HEUR:Trojan.Win32.Trickpak.gen
BitDefender	Gen:Variant.Zusy.369700
Paloalto	generic.ml
Ad-Aware	Gen:Variant.Zusy.369700
Sophos	Mal/Generic-S
Comodo	Malware@#1o0khlborbq1n
TrendMicro	TROJ_GEN.R002C0PCG21
McAfee-GW-Edition	Trojan-FTJO!955A8FAD4B34
FireEye	Generic.mg.955a8fad4b34c808
Emsisoft	Gen:Variant.Zusy.369700 (B)
Avira	TR/AD.TrickBot.hvnpd
MAX	malware (ai score=83)
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft	Trojan.Win32.Kryptik.oa
Microsoft	Trojan:Win32/TrickBot.DU!MTB
AegisLab	Trojan.Win32.Razy.4!c
ZoneAlarm	HEUR:Trojan.Win32.Trickpak.gen
GData	Gen:Variant.Zusy.369700
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.C4357109
McAfee	Trojan-FTJO!955A8FAD4B34
Malwarebytes	Trojan.TrickBot
ESET-NOD32	a variant of Win32/Kryptik.HJSD
TrendMicro-HouseCall	TROJ_GEN.R002C0PCG21
Rising	Trojan.Trickpak!8.122C7 (CLOUD)
Yandex	Trojan.Trickpak!LWxdBjhliG4
Ikarus	Trojan.Win32.Crypt
Fortinet	W32/Kryptik.FCDX!tr
AVG	Win32:BankerX-gen [Trj]
Panda	Trj/GdSda.A
Qihoo-360	Win32/TrojanPSW.Generic.Hx4C8SEA

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 events)

dead_host	154.126.176.30:449
dead_host	192.168.56.103:49599

mon93_cr.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All