Summary

37e2ccd1b5ced8b2_zxrpkhcaus.exe

File 37e2ccd1b5ced8b2_zxrpkhcaus.exe

Summary
Download Resubmit sample

Size 361.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b4ab4df9179017c806c797c87397ae07
SHA1 a296498561bec8b6ec5b2559855ccc74d3a34901
SHA256 37e2ccd1b5ced8b2355f8e9662ed90bad9c2ebc38c8e919a52153550790c7efc
SHA512
e986f2b47862c5b4d6685c3f740d721da1c935112c31d6284eb1b41d1b2462e6d3e60e888d8b2c36b374c047e5e71fdf42a8d528a67d68d129e835d878f66c06
CRC32 FE57348E
ssdeep None
PDB Path f:\软件工程\驱动编程\OK\KernelYK\bin\InstallSYS.pdb
Yara
  • vmdetect - Possibly employs anti-virtualization techniques
  • anti_dbg - Checks if being debugged
  • inject_thread - Code injection with CreateRemoteThread in a remote process
  • create_service - Create a windows service
  • network_http - Communications over HTTP
  • network_dropper - File downloader/dropper
  • network_tcp_socket - Communications over RAW socket
  • escalate_priv - Escalade priviledges
  • screenshot - Take screenshot
  • keylogger - Run a keylogger

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:6702928

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE July 18, 2025, 4:30 a.m. July 18, 2025, 4:37 a.m. 455 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-07-14 05:07:11,000 [analyzer] DEBUG: Starting analyzer from: C:\tmpwoh6zt
2025-07-14 05:07:11,000 [analyzer] DEBUG: Pipe server name: \??\PIPE\AYcetaWEggrGOBiffLw
2025-07-14 05:07:11,000 [analyzer] DEBUG: Log pipe server name: \??\PIPE\uUHYzyDoZxlRHQPSChvYFxNPqQY
2025-07-14 05:07:11,000 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-07-14 05:07:11,015 [analyzer] INFO: Automatically selected analysis package "exe"
2025-07-14 05:07:11,233 [analyzer] DEBUG: Started auxiliary module Curtain
2025-07-14 05:07:11,233 [analyzer] DEBUG: Started auxiliary module DbgView
2025-07-14 05:07:11,780 [analyzer] DEBUG: Started auxiliary module Disguise
2025-07-14 05:07:12,015 [analyzer] DEBUG: Loaded monitor into process with pid 500
2025-07-14 05:07:12,015 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-07-14 05:07:12,015 [analyzer] DEBUG: Started auxiliary module Human
2025-07-14 05:07:12,015 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-07-14 05:07:12,015 [analyzer] DEBUG: Started auxiliary module Reboot
2025-07-14 05:07:12,108 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-07-14 05:07:12,108 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-07-14 05:07:12,108 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-07-14 05:07:12,125 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-07-14 05:07:12,296 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\37e2ccd1b5ced8b2_zxrpkhcaus.exe' with arguments '' and pid 176
2025-07-14 05:07:12,483 [analyzer] DEBUG: Loaded monitor into process with pid 176
2025-07-14 05:07:13,000 [analyzer] INFO: Added new file to list with pid 176 and path C:\Temp\CreateProcess.exe
2025-07-14 05:07:14,000 [analyzer] INFO: Added new file to list with pid 176 and path C:\Temp\smkecwupmhfzpjhb.exe
2025-07-14 05:07:14,062 [analyzer] INFO: Injected into process with pid 2632 and name u'smkecwupmhfzpjhb.exe'
2025-07-14 05:07:14,171 [analyzer] INFO: Injected into process with pid 1368 and name u'iexplore.exe'
2025-07-14 05:07:14,203 [analyzer] DEBUG: Loaded monitor into process with pid 2632
2025-07-14 05:07:14,217 [analyzer] INFO: Added new file to list with pid 2632 and path \Device\NamedPipe\lsass
2025-07-14 05:07:14,405 [analyzer] DEBUG: Loaded monitor into process with pid 1368
2025-07-14 05:07:16,171 [analyzer] INFO: Added new file to list with pid 176 and path C:\Temp\smkecwupmhfzpjhb.sys
2025-07-14 05:07:16,312 [analyzer] INFO: Process with pid 176 has terminated
2025-07-14 05:07:16,890 [analyzer] INFO: Added new file to list with pid 2632 and path C:\Temp\qnifaysqki.exe
2025-07-14 05:07:16,953 [analyzer] INFO: Injected into process with pid 468 and name u'CreateProcess.exe'
2025-07-14 05:07:17,125 [analyzer] DEBUG: Loaded monitor into process with pid 468
2025-07-14 05:07:18,312 [analyzer] INFO: Process with pid 468 has terminated
2025-07-14 05:07:19,483 [analyzer] INFO: Added new file to list with pid 2632 and path C:\Temp\i_qnifaysqki.exe
2025-07-14 05:07:24,858 [analyzer] INFO: Added new file to list with pid 2632 and path C:\Temp\fdxvpnifax.exe
2025-07-14 05:10:31,312 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-07-14 05:10:32,217 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-07-14 05:10:32,217 [lib.api.process] INFO: Successfully terminated process with pid 2632.
2025-07-14 05:10:32,217 [lib.api.process] INFO: Successfully terminated process with pid 1368.
2025-07-14 05:10:32,233 [analyzer] WARNING: File at path u'\\device\\namedpipe\\lsass' does not exist, skip.
2025-07-14 05:10:32,250 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-07-18 04:30:24,440 [cuckoo.core.scheduler] INFO: Task #6729876: acquired machine win7x643 (label=win7x643)
2025-07-18 04:30:24,441 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.203 for task #6729876
2025-07-18 04:30:24,773 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 1701585 (interface=vboxnet0, host=192.168.168.203)
2025-07-18 04:30:25,260 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x643
2025-07-18 04:30:26,312 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x643 to vmcloak
2025-07-18 04:32:43,766 [cuckoo.core.guest] INFO: Starting analysis #6729876 on guest (id=win7x643, ip=192.168.168.203)
2025-07-18 04:32:44,770 [cuckoo.core.guest] DEBUG: win7x643: not ready yet
2025-07-18 04:32:49,794 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x643, ip=192.168.168.203)
2025-07-18 04:32:49,884 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x643, ip=192.168.168.203, monitor=latest, size=6660546)
2025-07-18 04:32:51,050 [cuckoo.core.resultserver] DEBUG: Task #6729876: live log analysis.log initialized.
2025-07-18 04:32:52,026 [cuckoo.core.resultserver] DEBUG: Task #6729876 is sending a BSON stream
2025-07-18 04:32:52,469 [cuckoo.core.resultserver] DEBUG: Task #6729876 is sending a BSON stream
2025-07-18 04:32:53,287 [cuckoo.core.resultserver] DEBUG: Task #6729876: File upload for 'shots/0001.jpg'
2025-07-18 04:32:53,302 [cuckoo.core.resultserver] DEBUG: Task #6729876 uploaded file length: 133456
2025-07-18 04:32:54,204 [cuckoo.core.resultserver] DEBUG: Task #6729876 is sending a BSON stream
2025-07-18 04:32:54,333 [cuckoo.core.resultserver] DEBUG: Task #6729876 is sending a BSON stream
2025-07-18 04:32:57,110 [cuckoo.core.resultserver] DEBUG: Task #6729876 is sending a BSON stream
2025-07-18 04:32:57,555 [cuckoo.core.resultserver] DEBUG: Task #6729876: File upload for 'files/0bf281ef94246e4c_qnifaysqki.exe'
2025-07-18 04:32:57,561 [cuckoo.core.resultserver] DEBUG: Task #6729876 uploaded file length: 369664
2025-07-18 04:33:02,257 [cuckoo.core.resultserver] DEBUG: Task #6729876: File upload for 'files/e401d24399c08ba3_i_qnifaysqki.exe'
2025-07-18 04:33:02,262 [cuckoo.core.resultserver] DEBUG: Task #6729876 uploaded file length: 369664
2025-07-18 04:33:05,731 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729876 still processing
2025-07-18 04:33:20,833 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729876 still processing
2025-07-18 04:33:35,934 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729876 still processing
2025-07-18 04:33:51,042 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729876 still processing
2025-07-18 04:34:06,186 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729876 still processing
2025-07-18 04:34:21,259 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729876 still processing
2025-07-18 04:34:36,449 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729876 still processing
2025-07-18 04:34:51,596 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729876 still processing
2025-07-18 04:35:06,713 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729876 still processing
2025-07-18 04:35:21,845 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729876 still processing
2025-07-18 04:35:36,967 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729876 still processing
2025-07-18 04:35:52,094 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729876 still processing
2025-07-18 04:36:07,292 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729876 still processing
2025-07-18 04:36:11,545 [cuckoo.core.resultserver] DEBUG: Task #6729876: File upload for 'curtain/1752462631.47.curtain.log'
2025-07-18 04:36:11,548 [cuckoo.core.resultserver] DEBUG: Task #6729876 uploaded file length: 36
2025-07-18 04:36:12,206 [cuckoo.core.resultserver] DEBUG: Task #6729876: File upload for 'sysmon/1752462632.14.sysmon.xml'
2025-07-18 04:36:12,291 [cuckoo.core.resultserver] DEBUG: Task #6729876 uploaded file length: 9558334
2025-07-18 04:36:12,307 [cuckoo.core.resultserver] DEBUG: Task #6729876: File upload for 'files/c7557d7ee391d0e9_fdxvpnifax.exe'
2025-07-18 04:36:12,310 [cuckoo.core.resultserver] DEBUG: Task #6729876: File upload for 'files/1205e47f5f569fba_createprocess.exe'
2025-07-18 04:36:12,312 [cuckoo.core.resultserver] DEBUG: Task #6729876 uploaded file length: 3584
2025-07-18 04:36:12,314 [cuckoo.core.resultserver] DEBUG: Task #6729876: File upload for 'files/83c1f533d73272a4_smkecwupmhfzpjhb.sys'
2025-07-18 04:36:12,317 [cuckoo.core.resultserver] DEBUG: Task #6729876 uploaded file length: 369664
2025-07-18 04:36:12,326 [cuckoo.core.resultserver] DEBUG: Task #6729876: File upload for 'files/b1b6b1f7b9031200_smkecwupmhfzpjhb.exe'
2025-07-18 04:36:12,329 [cuckoo.core.resultserver] DEBUG: Task #6729876 uploaded file length: 300544
2025-07-18 04:36:12,332 [cuckoo.core.resultserver] DEBUG: Task #6729876 uploaded file length: 369664
2025-07-18 04:36:12,338 [cuckoo.core.resultserver] DEBUG: Task #6729876 had connection reset for <Context for LOG>
2025-07-18 04:36:13,334 [cuckoo.core.guest] INFO: win7x643: analysis completed successfully
2025-07-18 04:36:13,348 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-07-18 04:36:13,374 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-07-18 04:36:14,311 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x643 to path /srv/cuckoo/cwd/storage/analyses/6729876/memory.dmp
2025-07-18 04:36:14,313 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x643
2025-07-18 04:37:59,088 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.203 for task #6729876
2025-07-18 04:37:59,822 [cuckoo.core.scheduler] DEBUG: Released database task #6729876
2025-07-18 04:37:59,865 [cuckoo.core.scheduler] INFO: Task #6729876: analysis procedure completed

Signatures

Yara rules detected for file (10 events)
description Possibly employs anti-virtualization techniques rule vmdetect
description Checks if being debugged rule anti_dbg
description Code injection with CreateRemoteThread in a remote process rule inject_thread
description Create a windows service rule create_service
description Communications over HTTP rule network_http
description File downloader/dropper rule network_dropper
description Communications over RAW socket rule network_tcp_socket
description Escalade priviledges rule escalate_priv
description Take screenshot rule screenshot
description Run a keylogger rule keylogger
Allocates read-write-execute memory (usually to unpack itself) (8 events)
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007feff0af000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007feff086000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007feff086000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007feff086000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefaa9b000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef32d4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3384000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1368
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002a60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
This executable has a PDB path (1 event)
pdb_path f:\软件工程\驱动编程\OK\KernelYK\bin\InstallSYS.pdb
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Foreign language identified in PE resource (7 events)
name RT_ICON language LANG_CHINESE filetype Device independent bitmap graphic, 13 x 26 x 8, image size 208, 256 important colors sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0005bec0 size 0x0000052c
name RT_ICON language LANG_CHINESE filetype Device independent bitmap graphic, 13 x 26 x 8, image size 208, 256 important colors sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0005bec0 size 0x0000052c
name RT_ICON language LANG_CHINESE filetype Device independent bitmap graphic, 13 x 26 x 8, image size 208, 256 important colors sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0005bec0 size 0x0000052c
name RT_ICON language LANG_CHINESE filetype Device independent bitmap graphic, 13 x 26 x 8, image size 208, 256 important colors sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0005bec0 size 0x0000052c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0005c3ec size 0x00000094
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0005c480 size 0x0000003e
name RT_VERSION language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0005c4c0 size 0x000002cc
Creates executable files on the filesystem (5 events)
file C:\Temp\i_qnifaysqki.exe
file C:\Temp\qnifaysqki.exe
file C:\Temp\smkecwupmhfzpjhb.exe
file C:\Temp\fdxvpnifax.exe
file C:\Temp\CreateProcess.exe
Creates a service (1 event)
Time & API Arguments Status Return Repeated

CreateServiceW

 service_start_name:
start_type: 3
password:
display_name: smkecwupmhfzpjhb
filepath: C:\Temp\smkecwupmhfzpjhb.sys
service_name: smkecwupmhfzpjhb
filepath_r: C:\Temp\smkecwupmhfzpjhb.sys
desired_access: 983551
service_handle: 0x003f83a8
error_control: 0
service_type: 1
service_manager_handle: 0x003f8448
1 4162472 0
Repeatedly searches for a not-found process, you may want to run a web browser during analysis (35 events)
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x00000064
process_name: 37E2CCD1B5CED8B2_ZXRPKHCAUS.EXE
process_identifier: 176
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: 37E2CCD1B5CED8B2_ZXRPKHCAUS.EXE
process_identifier: 176
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: 37E2CCD1B5CED8B2_ZXRPKHCAUS.EXE
process_identifier: 176
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: 37E2CCD1B5CED8B2_ZXRPKHCAUS.EXE
process_identifier: 176
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: 37E2CCD1B5CED8B2_ZXRPKHCAUS.EXE
process_identifier: 176
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: 37E2CCD1B5CED8B2_ZXRPKHCAUS.EXE
process_identifier: 176
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: 37E2CCD1B5CED8B2_ZXRPKHCAUS.EXE
process_identifier: 176
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: SMKECWUPMHFZPJHB.EXE
process_identifier: 2632
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: SMKECWUPMHFZPJHB.EXE
process_identifier: 2632
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: SMKECWUPMHFZPJHB.EXE
process_identifier: 2632
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: SMKECWUPMHFZPJHB.EXE
process_identifier: 2632
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: SMKECWUPMHFZPJHB.EXE
process_identifier: 2632
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: SMKECWUPMHFZPJHB.EXE
process_identifier: 2632
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: SMKECWUPMHFZPJHB.EXE
process_identifier: 2632
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: SMKECWUPMHFZPJHB.EXE
process_identifier: 2632
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: SMKECWUPMHFZPJHB.EXE
process_identifier: 2632
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: SMKECWUPMHFZPJHB.EXE
process_identifier: 2632
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: SMKECWUPMHFZPJHB.EXE
process_identifier: 2632
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: SMKECWUPMHFZPJHB.EXE
process_identifier: 2632
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: SMKECWUPMHFZPJHB.EXE
process_identifier: 2632
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: SMKECWUPMHFZPJHB.EXE
process_identifier: 2632
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: SMKECWUPMHFZPJHB.EXE
process_identifier: 2632
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: SMKECWUPMHFZPJHB.EXE
process_identifier: 2632
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: SMKECWUPMHFZPJHB.EXE
process_identifier: 2632
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: SMKECWUPMHFZPJHB.EXE
process_identifier: 2632
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: SMKECWUPMHFZPJHB.EXE
process_identifier: 2632
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: SMKECWUPMHFZPJHB.EXE
process_identifier: 2632
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: SMKECWUPMHFZPJHB.EXE
process_identifier: 2632
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: IEXPLORE.EXE
process_identifier: 1368
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: IEXPLORE.EXE
process_identifier: 1368
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: IEXPLORE.EXE
process_identifier: 1368
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: IEXPLORE.EXE
process_identifier: 1368
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: IEXPLORE.EXE
process_identifier: 1368
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: IEXPLORE.EXE
process_identifier: 1368
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: IEXPLORE.EXE
process_identifier: 1368
0 0
Uses Windows utilities for basic Windows functionality (1 event)
cmdline C:\Program Files\Internet Explorer\iexplore.exe http://xytets.com:2345/t.asp?os=home
File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)
G Data Antivirus (Windows) Virus: Trojan.Generic.7761207 (Engine A), Win32.Trojan.PSE1.YSVY3N (Engine B)
Avast Core Security (Linux) MBR:Backboot-D [Rtk]
C4S ClamAV (Linux) Win.Malware.Mikey-9949492-0
Trellix (Linux) Generic Dropper.aoe trojan
WithSecure (Linux) Trojan.TR/Rogue.7909438
eScan Antivirus (Linux) Trojan.Generic.7761207(DB)
ESET Security (Windows) Win32/Agent.PGA trojan
Sophos Anti-Virus (Linux) Troj/Drop-GZ
DrWeb Antivirus (Linux) Trojan.Click2.32800
ClamAV (Linux) Win.Malware.Mikey-9949492-0
Bitdefender Antivirus (Linux) Trojan.Generic.7761207
Kaspersky Standard (Windows) Trojan.Win32.Tiny.cm
Emsisoft Commandline Scanner (Windows) Trojan.Generic.7761207 (B)
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.