SmartHawk

5.4

中危

57 个模型检测该样本为恶意！

重新分析

下载样本

9c0ca340482798d9a62a26b8928e2bfcc20aee978a6b948d17d4a2c04c9adb0a

a82fe3286628c18a13d7101cf4ad9fa5.exe

分析耗时

94s

最近分析

文件大小

519.0KB

静态报毒动态报毒 100% AGENSLA AGENTTESLA AI SCORE=94 AUTO BUPKS4 CONFIDENCE CRYSISAGENTGLN ELDORADO FAREIT GENERICKD GRCKB GU0@AKJA5ZN HEAPOVERRIDE HIGH CONFIDENCE HUQWGF IGENT KCLOUD KRYPTIK KVMH008 MALICIOUS PE MALWARE@#EXYHFRZ9071Q MALWAREX PACKEDNET R350655 SAVE SCORE STATIC AI SUSGEN UNSAFE YAKBEEXMSIL ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FZF!A82FE3286628	20210211	6.0.6.653
Alibaba	TrojanSpy:MSIL/AgentTesla.734e5485	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:MalwareX-gen [Trj]	20210211	21.1.5827.0
Kingsoft	Win32.Heur.KVMH008.a.(kcloud)	20210212	2017.9.26.565
Tencent	Win32.Backdoor.Fareit.Auto	20210212	1.0.0.1
CrowdStrike	win/malicious_confidence_100% (W)	20210203	1.0

Checks if process is being debugged by a debugger (50 out of 117 个事件)

Time & API	Arguments	Status	Return	Repeated
1620808753.92175 IsDebuggerPresent		failed	0	0
1620808761.07775 IsDebuggerPresent		failed	0	0
1620808761.57775 IsDebuggerPresent		failed	0	0
1620808762.07775 IsDebuggerPresent		failed	0	0
1620808762.57775 IsDebuggerPresent		failed	0	0
1620808763.07775 IsDebuggerPresent		failed	0	0
1620808763.57775 IsDebuggerPresent		failed	0	0
1620808764.07775 IsDebuggerPresent		failed	0	0
1620808764.57775 IsDebuggerPresent		failed	0	0
1620808765.07775 IsDebuggerPresent		failed	0	0
1620808765.57775 IsDebuggerPresent		failed	0	0
1620808766.07775 IsDebuggerPresent		failed	0	0
1620808766.57775 IsDebuggerPresent		failed	0	0
1620808767.07775 IsDebuggerPresent		failed	0	0
1620808767.57775 IsDebuggerPresent		failed	0	0
1620808768.07775 IsDebuggerPresent		failed	0	0
1620808768.57775 IsDebuggerPresent		failed	0	0
1620808769.07775 IsDebuggerPresent		failed	0	0
1620808769.57775 IsDebuggerPresent		failed	0	0
1620808770.07775 IsDebuggerPresent		failed	0	0
1620808770.57775 IsDebuggerPresent		failed	0	0
1620808771.07775 IsDebuggerPresent		failed	0	0
1620808771.57775 IsDebuggerPresent		failed	0	0
1620808772.07775 IsDebuggerPresent		failed	0	0
1620808772.57775 IsDebuggerPresent		failed	0	0
1620808773.07775 IsDebuggerPresent		failed	0	0
1620808773.57775 IsDebuggerPresent		failed	0	0
1620808774.07775 IsDebuggerPresent		failed	0	0
1620808774.57775 IsDebuggerPresent		failed	0	0
1620808775.07775 IsDebuggerPresent		failed	0	0
1620808775.57775 IsDebuggerPresent		failed	0	0
1620808776.07775 IsDebuggerPresent		failed	0	0
1620808776.57775 IsDebuggerPresent		failed	0	0
1620808777.07775 IsDebuggerPresent		failed	0	0
1620808777.57775 IsDebuggerPresent		failed	0	0
1620808778.07775 IsDebuggerPresent		failed	0	0
1620808778.57775 IsDebuggerPresent		failed	0	0
1620808779.07775 IsDebuggerPresent		failed	0	0
1620808779.57775 IsDebuggerPresent		failed	0	0
1620808780.07775 IsDebuggerPresent		failed	0	0
1620808780.57775 IsDebuggerPresent		failed	0	0
1620808781.07775 IsDebuggerPresent		failed	0	0
1620808781.57775 IsDebuggerPresent		failed	0	0
1620808782.07775 IsDebuggerPresent		failed	0	0
1620808782.57775 IsDebuggerPresent		failed	0	0
1620808783.07775 IsDebuggerPresent		failed	0	0
1620808783.57775 IsDebuggerPresent		failed	0	0
1620808784.07775 IsDebuggerPresent		failed	0	0
1620808784.57775 IsDebuggerPresent		failed	0	0
1620808785.07775 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620808755.96875 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 个事件)

section	rKJ6\x7f\x7f:I
section

Allocates read-write-execute memory (usually to unpack itself) (50 out of 102 个事件)

Time & API	Arguments	Status
1620808752.12475 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00340000	success
1620808752.12475 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a0000	success
1620808753.81175 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c51000	success
1620808753.92175 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003fa000	success
1620808753.92175 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c52000	success
1620808753.92175 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f2000	success
1620808754.21875 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00402000	success
1620808754.32775 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00403000	success
1620808754.34375 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0043b000	success
1620808754.34375 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00437000	success
1620808754.35875 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0040c000	success
1620808754.43675 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a00000	success
1620808754.65575 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00404000	success
1620808754.67175 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a01000	success
1620808754.68675 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0040a000	success
1620808754.85875 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 417792 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x013c2000	success
1620808760.13975 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a02000	success
1620808760.17175 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a03000	success
1620808760.17175 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a04000	success
1620808760.20275 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a05000	success
1620808760.46875 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00405000	success
1620808760.48375 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a06000	success
1620808760.53075 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a07000	success
1620808760.53075 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success
1620808760.53075 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success
1620808760.53075 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x013c0000	success
1620808760.53075 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x013c0000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x013c0000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x013c0000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x013c0000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success
1620808760.54675 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01428000	success

A process attempted to delay the analysis task. (1 个事件)

description

a82fe3286628c18a13d7101cf4ad9fa5.exe tried to sleep 169 seconds, actually delayed analysis time by 169 seconds

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.999563105803564

section

{'size_of_data': '0x00065600', 'virtual_address': '0x00002000', 'entropy': 7.999563105803564, 'name': 'rKJ6\\x7f\\x7f:I', 'virtual_size': '0x000654c4'}

description

A section with a high entropy has been found

entropy

0.7828185328185329

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620808754.84375 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (3 个事件)

host	113.108.239.196
host	172.217.24.14
host	45.83.176.82

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)

Bkav	W32.CrysisAgentGLN.Trojan
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34491911
FireEye	Generic.mg.a82fe3286628c18a
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
McAfee	Fareit-FZF!A82FE3286628
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0056df191 )
Alibaba	TrojanSpy:MSIL/AgentTesla.734e5485
K7GW	Trojan ( 0056df191 )
Cybereason	malicious.86628c
Arcabit	Trojan.Generic.D20E4E07
BitDefenderTheta	Gen:NN.ZemsilF.34804.Gu0@aKjA5Zn
Cyren	W32/MSIL_Kryptik.BOS.gen!Eldorado
Symantec	Trojan Horse
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender	Trojan.GenericKD.34491911
NANO-Antivirus	Trojan.Win32.Agensla.huqwgf
Paloalto	generic.ml
ViRobot	Trojan.Win32.Z.Kryptik.531456.AB
Ad-Aware	Trojan.GenericKD.34491911
Sophos	Mal/Generic-S
Comodo	Malware@#exyhfrz9071q
F-Secure	Trojan.TR/Dropper.MSIL.grckb
DrWeb	Trojan.PackedNET.424
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.hc
Emsisoft	Trojan.GenericKD.34491911 (B)
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.74499699.susgen
Avira	TR/Dropper.MSIL.grckb
Kingsoft	Win32.Heur.KVMH008.a.(kcloud)
Gridinsoft	Trojan.Win32.Kryptik.oa
Microsoft	TrojanSpy:MSIL/AgentTesla.SD!MTB
AegisLab	Trojan.MSIL.Agensla.i!c
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
GData	Trojan.GenericKD.34491911
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Kryptik.R350655
VBA32	CIL.HeapOverride.Heur
ALYac	Spyware.AgentTesla
Malwarebytes	Trojan.Crypt.Generic
Zoner	Trojan.Win32.93638
ESET-NOD32	a variant of MSIL/Kryptik.XQL
Tencent	Win32.Backdoor.Fareit.Auto
Yandex	Trojan.Igent.bUpKS4.20
MAX	malware (ai score=94)

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-09-08 13:02:03

Imports

Library mscoree.dll:

• 0x488000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	142.250.66.110
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.