Size | 738.0B |
---|---|
Type | DOS batch file, ASCII text, with CRLF line terminators |
MD5 | ff8f9a20c00d9d41836bfa4fac3244a9 |
SHA1 | 9ee53e3f4273508b2d3fcdbc8b192037d8bb55c0 |
SHA256 | 4b825d310a305728b7a57d9eb6731db87e8da9cef4bc7917fca7f4503bcb3272 |
SHA512 |
15b3bc9370e058db957c6bdf34b2f440650513727b6b134308d8f4a76728a21e378da39af6cb7f5012b166585ff8abf7327a4a4b972004dd1e09f6a02a4af0bb
|
CRC32 | A5F43B5B |
ssdeep | None |
Yara |
|
This file is very suspicious, with a score of 10 out of 10!
Please notice: The scoring system is currently still in development and should be considered an alpha feature.
Expecting different results? Send us this analysis and we will inspect it. Click here
Category | Started | Completed | Duration | Routing | Logs |
---|---|---|---|---|---|
FILE | Dec. 18, 2024, 9:11 p.m. | Dec. 18, 2024, 9:18 p.m. | 473 seconds | internet |
Show Analyzer Log Show Cuckoo Log |
2024-12-18 14:23:15,001 [root] DEBUG: Starting analyzer from: /tmp/tmp4rbilU 2024-12-18 14:23:15,001 [root] DEBUG: Storing results at: /tmp/QABhIkvXi 2024-12-18 14:23:15,001 [lib.core.packages] INFO: _guess_package_name failed 2024-12-18 14:23:15,001 [lib.core.packages] INFO: DOS batch file, ASCII text, with CRLF line terminators 2024-12-18 14:23:15,001 [lib.core.packages] INFO: ff8f9a20c00d9d41836bfa4fac3244a9 2024-12-18 14:23:16,870 [modules.auxiliary.filecollector] INFO: FileCollector started v0.08 2024-12-18 14:23:16,872 [modules.auxiliary.human] INFO: Human started v0.02 2024-12-18 14:23:17,379 [modules.auxiliary.screenshots] INFO: Screenshots started v0.03 2024-12-18 14:23:26,712 [lib.core.packages] INFO: Process startup took 9.33 seconds 2024-12-18 14:23:26,713 [root] INFO: Added new process to list with pid: 2066 2024-12-18 14:23:38,731 [root] INFO: Process with pid 2066 has terminated 2024-12-18 14:23:38,731 [root] INFO: Process list is empty, terminating analysis. 2024-12-18 14:23:41,735 [lib.core.packages] INFO: Package requested stop 2024-12-18 14:23:41,736 [lib.core.packages] WARNING: Exception uploading log: [Errno 3] No such process
2024-12-18 21:11:03,451 [cuckoo.core.scheduler] INFO: Task #5670536: acquired machine Ubuntu1904x647 (label=Ubuntu1904x647) 2024-12-18 21:11:03,452 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.107 for task #5670536 2024-12-18 21:11:04,021 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 289001 (interface=vboxnet0, host=192.168.168.107) 2024-12-18 21:11:04,074 [cuckoo.machinery.virtualbox] DEBUG: Starting vm Ubuntu1904x647 2024-12-18 21:11:04,965 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine Ubuntu1904x647 to Snapshot 2024-12-18 21:14:00,851 [cuckoo.core.guest] INFO: Starting analysis #5670536 on guest (id=Ubuntu1904x647, ip=192.168.168.107) 2024-12-18 21:14:01,856 [cuckoo.core.guest] DEBUG: Ubuntu1904x647: not ready yet 2024-12-18 21:14:06,879 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=Ubuntu1904x647, ip=192.168.168.107) 2024-12-18 21:14:06,903 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=Ubuntu1904x647, ip=192.168.168.107, monitor=latest, size=73219) 2024-12-18 21:14:07,081 [cuckoo.core.resultserver] DEBUG: Task #5670536: live log analysis.log initialized. 2024-12-18 21:14:12,407 [cuckoo.core.resultserver] DEBUG: Task #5670536: File upload for 'shots/0001.jpg' 2024-12-18 21:14:12,419 [cuckoo.core.resultserver] DEBUG: Task #5670536 uploaded file length: 171589 2024-12-18 21:14:22,098 [cuckoo.core.guest] DEBUG: Ubuntu1904x647: analysis #5670536 still processing 2024-12-18 21:14:33,828 [cuckoo.core.resultserver] DEBUG: Task #5670536: File upload for 'logs/all.stap' 2024-12-18 21:14:33,831 [cuckoo.core.resultserver] DEBUG: Task #5670536 uploaded file length: 8858 2024-12-18 21:14:37,342 [cuckoo.core.guest] DEBUG: Ubuntu1904x647: analysis #5670536 still processing 2024-12-18 21:14:52,701 [cuckoo.core.guest] DEBUG: Ubuntu1904x647: analysis #5670536 still processing 2024-12-18 21:15:07,894 [cuckoo.core.guest] DEBUG: Ubuntu1904x647: analysis #5670536 still processing 2024-12-18 21:15:22,971 [cuckoo.core.guest] DEBUG: Ubuntu1904x647: analysis #5670536 still processing 2024-12-18 21:15:38,563 [cuckoo.core.guest] DEBUG: Ubuntu1904x647: analysis #5670536 still processing 2024-12-18 21:15:53,791 [cuckoo.core.guest] DEBUG: Ubuntu1904x647: analysis #5670536 still processing 2024-12-18 21:16:09,133 [cuckoo.core.guest] DEBUG: Ubuntu1904x647: analysis #5670536 still processing 2024-12-18 21:16:24,256 [cuckoo.core.guest] DEBUG: Ubuntu1904x647: analysis #5670536 still processing 2024-12-18 21:16:39,332 [cuckoo.core.guest] INFO: Ubuntu1904x647: end of analysis reached! 2024-12-18 21:16:39,350 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks 2024-12-18 21:16:39,369 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer 2024-12-18 21:16:40,838 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label Ubuntu1904x647 to path /srv/cuckoo/cwd/storage/analyses/5670536/memory.dmp 2024-12-18 21:16:40,853 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm Ubuntu1904x647 2024-12-18 21:18:56,680 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.107 for task #5670536 2024-12-18 21:18:56,680 [cuckoo.core.resultserver] DEBUG: Cancel <Context for LOG> for task 5670536 2024-12-18 21:18:57,263 [cuckoo.core.scheduler] DEBUG: Released database task #5670536 2024-12-18 21:18:57,291 [cuckoo.core.scheduler] INFO: Task #5670536: analysis procedure completed
description | Detects the downloader batch file script used by Konni FTP | rule | CrowdStrike_CSIT_19196_02 |
ESET Security (Windows) | BAT/TrojanDownloader.Agent.NVF trojan |
McAfee CLI scanner (Linux) | BAT/Agent.o trojan |
Kaspersky Standard (Windows) | Trojan-Downloader.BAT.Agent.xn |
ALYac | Trojan.Downloader.BAT.A |
Symantec | Trojan.Gen.2 |
McAfee-GW-Edition | BAT/Agent.o |
Sophos | Troj/Dloadr-EEQ |
Antiy-AVL | Trojan/Generic.Generic |
Microsoft | PUA:Win32/Presenoker |
McAfee | BAT/Agent.o |
Tencent | Bat.Trojan-downloader.Agent.Egyh |