Summary

6b490819a7dd93fb_omhezwrpjh.exe

File 6b490819a7dd93fb_omhezwrpjh.exe

Summary
Download Resubmit sample

Size 361.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 414d9b96d0860c0927130bcb58102c8d
SHA1 ceee4a20da5bff689106db8c8d1312b84e5acd57
SHA256 6b490819a7dd93fbc34e06ef4ceaf434a3d4f54005b7f747322815687a809ebd
SHA512
df526e960fb6b74c2aaccb589e3d845a3380d443cf343ab71c2b5f302fab8f44afb7684b8f25b4f1197e8fc9f2f6a3af10a33da35b259a8027733ad5a5a261d1
CRC32 0918D583
ssdeep None
PDB Path f:\软件工程\驱动编程\OK\KernelYK\bin\InstallSYS.pdb
Yara
  • vmdetect - Possibly employs anti-virtualization techniques
  • anti_dbg - Checks if being debugged
  • inject_thread - Code injection with CreateRemoteThread in a remote process
  • create_service - Create a windows service
  • network_http - Communications over HTTP
  • network_dropper - File downloader/dropper
  • network_tcp_socket - Communications over RAW socket
  • escalate_priv - Escalade priviledges
  • screenshot - Take screenshot
  • keylogger - Run a keylogger

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:6687576

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE July 16, 2025, 8:11 p.m. July 16, 2025, 8:16 p.m. 292 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-07-11 20:13:44,030 [analyzer] DEBUG: Starting analyzer from: C:\tmpl4240h
2025-07-11 20:13:44,046 [analyzer] DEBUG: Pipe server name: \??\PIPE\asMsTDuEZfhUnIzMh
2025-07-11 20:13:44,046 [analyzer] DEBUG: Log pipe server name: \??\PIPE\DEYxlKUcRUedNWOyAuoAmybKtpkLd
2025-07-11 20:13:44,062 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-07-11 20:13:44,125 [analyzer] INFO: Automatically selected analysis package "exe"
2025-07-11 20:13:44,546 [analyzer] DEBUG: Started auxiliary module Curtain
2025-07-11 20:13:44,546 [analyzer] DEBUG: Started auxiliary module DbgView
2025-07-11 20:13:45,062 [analyzer] DEBUG: Started auxiliary module Disguise
2025-07-11 20:13:45,280 [analyzer] DEBUG: Loaded monitor into process with pid 508
2025-07-11 20:13:45,280 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-07-11 20:13:45,280 [analyzer] DEBUG: Started auxiliary module Human
2025-07-11 20:13:45,280 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-07-11 20:13:45,296 [analyzer] DEBUG: Started auxiliary module Reboot
2025-07-11 20:13:45,390 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-07-11 20:13:45,390 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-07-11 20:13:45,390 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-07-11 20:13:45,390 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-07-11 20:13:45,530 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\6b490819a7dd93fb_omhezwrpjh.exe' with arguments '' and pid 2304
2025-07-11 20:13:45,717 [analyzer] DEBUG: Loaded monitor into process with pid 2304
2025-07-11 20:13:46,265 [analyzer] INFO: Added new file to list with pid 2304 and path C:\Temp\CreateProcess.exe
2025-07-11 20:13:47,265 [analyzer] INFO: Added new file to list with pid 2304 and path C:\Temp\wugezwrpjhbztrmj.exe
2025-07-11 20:13:47,358 [analyzer] INFO: Injected into process with pid 2432 and name u'wugezwrpjhbztrmj.exe'
2025-07-11 20:13:47,515 [analyzer] INFO: Injected into process with pid 552 and name u'iexplore.exe'
2025-07-11 20:13:47,530 [analyzer] DEBUG: Loaded monitor into process with pid 2432
2025-07-11 20:13:47,562 [analyzer] INFO: Added new file to list with pid 2432 and path \Device\NamedPipe\lsass
2025-07-11 20:13:47,733 [analyzer] DEBUG: Loaded monitor into process with pid 552
2025-07-11 20:13:49,515 [analyzer] INFO: Added new file to list with pid 2304 and path C:\Temp\wugezwrpjhbztrmj.sys
2025-07-11 20:13:50,233 [analyzer] INFO: Added new file to list with pid 2432 and path C:\Temp\sqkidanlfd.exe
2025-07-11 20:13:50,280 [analyzer] INFO: Injected into process with pid 468 and name u'CreateProcess.exe'
2025-07-11 20:13:50,421 [analyzer] DEBUG: Loaded monitor into process with pid 468
2025-07-11 20:13:50,546 [analyzer] INFO: Process with pid 2304 has terminated
2025-07-11 20:13:51,546 [analyzer] INFO: Process with pid 468 has terminated
2025-07-11 20:13:52,703 [analyzer] INFO: Added new file to list with pid 2432 and path C:\Temp\i_sqkidanlfd.exe
2025-07-11 20:13:58,125 [analyzer] INFO: Added new file to list with pid 2432 and path C:\Temp\nhfaxspkic.exe
2025-07-11 20:17:04,562 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-07-11 20:17:06,000 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-07-11 20:17:06,015 [lib.api.process] INFO: Successfully terminated process with pid 2432.
2025-07-11 20:17:06,015 [lib.api.process] INFO: Successfully terminated process with pid 552.
2025-07-11 20:17:06,015 [analyzer] WARNING: File at path u'\\device\\namedpipe\\lsass' does not exist, skip.
2025-07-11 20:17:06,062 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-07-16 20:11:17,824 [cuckoo.core.scheduler] INFO: Task #6721104: acquired machine win7x649 (label=win7x649)
2025-07-16 20:11:17,829 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.209 for task #6721104
2025-07-16 20:11:18,103 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 2815551 (interface=vboxnet0, host=192.168.168.209)
2025-07-16 20:11:19,373 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x649
2025-07-16 20:11:20,338 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x649 to vmcloak
2025-07-16 20:11:38,533 [cuckoo.core.guest] INFO: Starting analysis #6721104 on guest (id=win7x649, ip=192.168.168.209)
2025-07-16 20:11:39,546 [cuckoo.core.guest] DEBUG: win7x649: not ready yet
2025-07-16 20:11:44,573 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x649, ip=192.168.168.209)
2025-07-16 20:11:44,681 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x649, ip=192.168.168.209, monitor=latest, size=6660546)
2025-07-16 20:11:46,174 [cuckoo.core.resultserver] DEBUG: Task #6721104: live log analysis.log initialized.
2025-07-16 20:11:47,408 [cuckoo.core.resultserver] DEBUG: Task #6721104 is sending a BSON stream
2025-07-16 20:11:47,821 [cuckoo.core.resultserver] DEBUG: Task #6721104 is sending a BSON stream
2025-07-16 20:11:48,750 [cuckoo.core.resultserver] DEBUG: Task #6721104: File upload for 'shots/0001.jpg'
2025-07-16 20:11:48,772 [cuckoo.core.resultserver] DEBUG: Task #6721104 uploaded file length: 133456
2025-07-16 20:11:49,644 [cuckoo.core.resultserver] DEBUG: Task #6721104 is sending a BSON stream
2025-07-16 20:11:49,801 [cuckoo.core.resultserver] DEBUG: Task #6721104 is sending a BSON stream
2025-07-16 20:11:52,549 [cuckoo.core.resultserver] DEBUG: Task #6721104 is sending a BSON stream
2025-07-16 20:11:52,898 [cuckoo.core.resultserver] DEBUG: Task #6721104: File upload for 'files/474a7a501a62b30d_sqkidanlfd.exe'
2025-07-16 20:11:52,925 [cuckoo.core.resultserver] DEBUG: Task #6721104 uploaded file length: 369664
2025-07-16 20:11:57,658 [cuckoo.core.resultserver] DEBUG: Task #6721104: File upload for 'files/b5f1f50cf6cd8657_i_sqkidanlfd.exe'
2025-07-16 20:11:57,667 [cuckoo.core.resultserver] DEBUG: Task #6721104 uploaded file length: 369664
2025-07-16 20:12:00,805 [cuckoo.core.guest] DEBUG: win7x649: analysis #6721104 still processing
2025-07-16 20:12:15,947 [cuckoo.core.guest] DEBUG: win7x649: analysis #6721104 still processing
2025-07-16 20:12:31,033 [cuckoo.core.guest] DEBUG: win7x649: analysis #6721104 still processing
2025-07-16 20:12:46,135 [cuckoo.core.guest] DEBUG: win7x649: analysis #6721104 still processing
2025-07-16 20:13:01,231 [cuckoo.core.guest] DEBUG: win7x649: analysis #6721104 still processing
2025-07-16 20:13:16,361 [cuckoo.core.guest] DEBUG: win7x649: analysis #6721104 still processing
2025-07-16 20:13:31,491 [cuckoo.core.guest] DEBUG: win7x649: analysis #6721104 still processing
2025-07-16 20:13:46,619 [cuckoo.core.guest] DEBUG: win7x649: analysis #6721104 still processing
2025-07-16 20:14:01,807 [cuckoo.core.guest] DEBUG: win7x649: analysis #6721104 still processing
2025-07-16 20:14:16,957 [cuckoo.core.guest] DEBUG: win7x649: analysis #6721104 still processing
2025-07-16 20:14:32,096 [cuckoo.core.guest] DEBUG: win7x649: analysis #6721104 still processing
2025-07-16 20:14:47,248 [cuckoo.core.guest] DEBUG: win7x649: analysis #6721104 still processing
2025-07-16 20:15:02,429 [cuckoo.core.guest] DEBUG: win7x649: analysis #6721104 still processing
2025-07-16 20:15:07,018 [cuckoo.core.resultserver] DEBUG: Task #6721104: File upload for 'curtain/1752257824.81.curtain.log'
2025-07-16 20:15:07,022 [cuckoo.core.resultserver] DEBUG: Task #6721104 uploaded file length: 36
2025-07-16 20:15:08,074 [cuckoo.core.resultserver] DEBUG: Task #6721104: File upload for 'sysmon/1752257825.88.sysmon.xml'
2025-07-16 20:15:08,229 [cuckoo.core.resultserver] DEBUG: Task #6721104 uploaded file length: 10521658
2025-07-16 20:15:08,289 [cuckoo.core.resultserver] DEBUG: Task #6721104 had connection reset for <Context for LOG>
2025-07-16 20:15:08,293 [cuckoo.core.resultserver] DEBUG: Task #6721104: File upload for 'files/a793a3f54c65c34a_nhfaxspkic.exe'
2025-07-16 20:15:08,297 [cuckoo.core.resultserver] DEBUG: Task #6721104: File upload for 'files/a7197bafa067a843_wugezwrpjhbztrmj.exe'
2025-07-16 20:15:08,299 [cuckoo.core.resultserver] DEBUG: Task #6721104: File upload for 'files/9abb0714de86f91b_createprocess.exe'
2025-07-16 20:15:08,301 [cuckoo.core.resultserver] DEBUG: Task #6721104 uploaded file length: 3584
2025-07-16 20:15:08,302 [cuckoo.core.resultserver] DEBUG: Task #6721104: File upload for 'files/76dd2c118d0415dd_wugezwrpjhbztrmj.sys'
2025-07-16 20:15:08,307 [cuckoo.core.resultserver] DEBUG: Task #6721104 uploaded file length: 300544
2025-07-16 20:15:08,367 [cuckoo.core.resultserver] DEBUG: Task #6721104 uploaded file length: 369664
2025-07-16 20:15:08,437 [cuckoo.core.resultserver] DEBUG: Task #6721104 uploaded file length: 369664
2025-07-16 20:15:08,466 [cuckoo.core.guest] INFO: win7x649: analysis completed successfully
2025-07-16 20:15:08,493 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-07-16 20:15:08,519 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-07-16 20:15:09,433 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x649 to path /srv/cuckoo/cwd/storage/analyses/6721104/memory.dmp
2025-07-16 20:15:09,435 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x649
2025-07-16 20:16:09,482 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.209 for task #6721104
2025-07-16 20:16:09,893 [cuckoo.core.scheduler] DEBUG: Released database task #6721104
2025-07-16 20:16:09,909 [cuckoo.core.scheduler] INFO: Task #6721104: analysis procedure completed

Signatures

Yara rules detected for file (10 events)
description Possibly employs anti-virtualization techniques rule vmdetect
description Checks if being debugged rule anti_dbg
description Code injection with CreateRemoteThread in a remote process rule inject_thread
description Create a windows service rule create_service
description Communications over HTTP rule network_http
description File downloader/dropper rule network_dropper
description Communications over RAW socket rule network_tcp_socket
description Escalade priviledges rule escalate_priv
description Take screenshot rule screenshot
description Run a keylogger rule keylogger
Allocates read-write-execute memory (usually to unpack itself) (8 events)
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007feffc1f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007feffbf6000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007feffbf6000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007feffbf6000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefb58b000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3ac4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3be4000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 552
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000003410000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
This executable has a PDB path (1 event)
pdb_path f:\软件工程\驱动编程\OK\KernelYK\bin\InstallSYS.pdb
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Foreign language identified in PE resource (7 events)
name RT_ICON language LANG_CHINESE filetype Device independent bitmap graphic, 13 x 26 x 8, image size 208, 256 important colors sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0005bec0 size 0x0000052c
name RT_ICON language LANG_CHINESE filetype Device independent bitmap graphic, 13 x 26 x 8, image size 208, 256 important colors sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0005bec0 size 0x0000052c
name RT_ICON language LANG_CHINESE filetype Device independent bitmap graphic, 13 x 26 x 8, image size 208, 256 important colors sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0005bec0 size 0x0000052c
name RT_ICON language LANG_CHINESE filetype Device independent bitmap graphic, 13 x 26 x 8, image size 208, 256 important colors sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0005bec0 size 0x0000052c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0005c3ec size 0x00000094
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0005c480 size 0x0000003e
name RT_VERSION language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0005c4c0 size 0x000002cc
Creates executable files on the filesystem (5 events)
file C:\Temp\nhfaxspkic.exe
file C:\Temp\wugezwrpjhbztrmj.exe
file C:\Temp\i_sqkidanlfd.exe
file C:\Temp\sqkidanlfd.exe
file C:\Temp\CreateProcess.exe
Creates a service (1 event)
Time & API Arguments Status Return Repeated

CreateServiceW

 service_start_name:
start_type: 3
password:
display_name: wugezwrpjhbztrmj
filepath: C:\Temp\wugezwrpjhbztrmj.sys
service_name: wugezwrpjhbztrmj
filepath_r: C:\Temp\wugezwrpjhbztrmj.sys
desired_access: 983551
service_handle: 0x003083a8
error_control: 0
service_type: 1
service_manager_handle: 0x00308448
1 3179432 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 event)
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x00000064
process_name: mobsync.exe
process_identifier: 3068
1 1 0
Repeatedly searches for a not-found process, you may want to run a web browser during analysis (35 events)
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x00000064
process_name: 6B490819A7DD93FB_OMHEZWRPJH.EXE
process_identifier: 2304
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: 6B490819A7DD93FB_OMHEZWRPJH.EXE
process_identifier: 2304
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: 6B490819A7DD93FB_OMHEZWRPJH.EXE
process_identifier: 2304
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: 6B490819A7DD93FB_OMHEZWRPJH.EXE
process_identifier: 2304
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: 6B490819A7DD93FB_OMHEZWRPJH.EXE
process_identifier: 2304
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: 6B490819A7DD93FB_OMHEZWRPJH.EXE
process_identifier: 2304
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: 6B490819A7DD93FB_OMHEZWRPJH.EXE
process_identifier: 2304
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: WUGEZWRPJHBZTRMJ.EXE
process_identifier: 2432
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: WUGEZWRPJHBZTRMJ.EXE
process_identifier: 2432
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: WUGEZWRPJHBZTRMJ.EXE
process_identifier: 2432
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: WUGEZWRPJHBZTRMJ.EXE
process_identifier: 2432
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: WUGEZWRPJHBZTRMJ.EXE
process_identifier: 2432
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: WUGEZWRPJHBZTRMJ.EXE
process_identifier: 2432
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: WUGEZWRPJHBZTRMJ.EXE
process_identifier: 2432
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: WUGEZWRPJHBZTRMJ.EXE
process_identifier: 2432
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: WUGEZWRPJHBZTRMJ.EXE
process_identifier: 2432
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: WUGEZWRPJHBZTRMJ.EXE
process_identifier: 2432
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: WUGEZWRPJHBZTRMJ.EXE
process_identifier: 2432
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: WUGEZWRPJHBZTRMJ.EXE
process_identifier: 2432
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: WUGEZWRPJHBZTRMJ.EXE
process_identifier: 2432
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: WUGEZWRPJHBZTRMJ.EXE
process_identifier: 2432
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: WUGEZWRPJHBZTRMJ.EXE
process_identifier: 2432
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: WUGEZWRPJHBZTRMJ.EXE
process_identifier: 2432
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: WUGEZWRPJHBZTRMJ.EXE
process_identifier: 2432
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: WUGEZWRPJHBZTRMJ.EXE
process_identifier: 2432
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: WUGEZWRPJHBZTRMJ.EXE
process_identifier: 2432
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: WUGEZWRPJHBZTRMJ.EXE
process_identifier: 2432
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: WUGEZWRPJHBZTRMJ.EXE
process_identifier: 2432
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: IEXPLORE.EXE
process_identifier: 552
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: IEXPLORE.EXE
process_identifier: 552
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: IEXPLORE.EXE
process_identifier: 552
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: IEXPLORE.EXE
process_identifier: 552
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: IEXPLORE.EXE
process_identifier: 552
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: IEXPLORE.EXE
process_identifier: 552
0 0

Process32NextW

 snapshot_handle: 0x00000064
process_name: IEXPLORE.EXE
process_identifier: 552
0 0
Uses Windows utilities for basic Windows functionality (1 event)
cmdline C:\Program Files\Internet Explorer\iexplore.exe http://xytets.com:2345/t.asp?os=home
File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)
G Data Antivirus (Windows) Virus: Trojan.Generic.7761207 (Engine A), Win32.Trojan.PSE1.YSVY3N (Engine B)
Avast Core Security (Linux) MBR:Backboot-D [Rtk]
C4S ClamAV (Linux) Win.Malware.Mikey-9949492-0
Trellix (Linux) Generic Dropper.aoe trojan
WithSecure (Linux) Trojan.TR/Rogue.7909438
eScan Antivirus (Linux) Trojan.Generic.7761207(DB)
ESET Security (Windows) Win32/Agent.PGA trojan
Sophos Anti-Virus (Linux) Troj/Drop-GZ
DrWeb Antivirus (Linux) Trojan.Click2.32800
ClamAV (Linux) Win.Malware.Mikey-9949492-0
Bitdefender Antivirus (Linux) Trojan.Generic.7761207
Kaspersky Standard (Windows) Trojan.Win32.Tiny.cm
Emsisoft Commandline Scanner (Windows) Trojan.Generic.7761207 (B)
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.