Summary

50a46b3120da8285_broomsetup.exe

File 50a46b3120da8285_broomsetup.exe

Summary
Download Resubmit sample

Size 4.7MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 5e94f0f6265f9e8b2f706f1d46bbd39e
SHA1 d0189cba430f5eea07efe1ab4f89adf5ae2453db
SHA256 50a46b3120da828502ef0caba15defbad004a3adb88e6eacf1f9604572e2d503
SHA512
473dfa66a36feed9b29a43245074141478327ce22ba7cce512599379dcb783b4d665e2d65c5e9750b988c7ed8f6c3349a7a12d4b8b57c89840eee6ca6e1a30cd
CRC32 E8BF1656
ssdeep None
Yara
  • GenerateTLSClientHelloPacket_Test - (no description)
  • anti_dbg - Checks if being debugged
  • inject_thread - Code injection with CreateRemoteThread in a remote process
  • escalate_priv - Escalade priviledges
  • screenshot - Take screenshot
  • keylogger - Run a keylogger
  • win_registry - Affect system registries
  • win_token - Affect system token
  • win_files_operation - Affect private profile
  • win_hook - Affect hook table

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:6962612

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE Sept. 9, 2025, 5:20 a.m. Sept. 9, 2025, 5:27 a.m. 419 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-09-09 05:18:24,015 [analyzer] DEBUG: Starting analyzer from: C:\tmptisd8w
2025-09-09 05:18:24,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\SSipnZrsXdLqoXUq
2025-09-09 05:18:24,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\altlcLpbWaCumSiFvNfXe
2025-09-09 05:18:24,015 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-09-09 05:18:24,046 [analyzer] INFO: Automatically selected analysis package "exe"
2025-09-09 05:18:24,296 [analyzer] DEBUG: Started auxiliary module Curtain
2025-09-09 05:18:24,312 [analyzer] DEBUG: Started auxiliary module DbgView
2025-09-09 05:18:24,828 [analyzer] DEBUG: Started auxiliary module Disguise
2025-09-09 05:18:25,125 [analyzer] DEBUG: Loaded monitor into process with pid 508
2025-09-09 05:18:25,125 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-09-09 05:18:25,125 [analyzer] DEBUG: Started auxiliary module Human
2025-09-09 05:18:25,125 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-09-09 05:18:25,140 [analyzer] DEBUG: Started auxiliary module Reboot
2025-09-09 05:18:25,250 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-09-09 05:18:25,250 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-09-09 05:18:25,250 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-09-09 05:18:25,250 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-09-09 05:18:25,453 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\50a46b3120da8285_broomsetup.exe' with arguments '' and pid 608
2025-09-09 05:18:25,671 [analyzer] DEBUG: Loaded monitor into process with pid 608
2025-09-09 05:18:34,265 [analyzer] INFO: Added new file to list with pid 608 and path C:\Users\Administrator\AppData\Roaming\Temp\Task.bat
2025-09-09 05:18:34,342 [analyzer] INFO: Injected into process with pid 1992 and name u'cmd.exe'
2025-09-09 05:18:34,640 [analyzer] DEBUG: Loaded monitor into process with pid 1992
2025-09-09 05:18:34,828 [analyzer] INFO: Injected into process with pid 900 and name u'chcp.com'
2025-09-09 05:18:34,983 [analyzer] DEBUG: Loaded monitor into process with pid 900
2025-09-09 05:18:35,203 [analyzer] INFO: Injected into process with pid 2440 and name u'schtasks.exe'
2025-09-09 05:18:35,375 [analyzer] DEBUG: Loaded monitor into process with pid 2440
2025-09-09 05:18:35,453 [analyzer] INFO: Process with pid 900 has terminated
2025-09-09 05:18:36,453 [analyzer] INFO: Process with pid 1992 has terminated
2025-09-09 05:18:37,453 [analyzer] INFO: Process with pid 2440 has terminated
2025-09-09 04:27:30,203 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-09-09 04:27:30,875 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-09-09 04:27:30,875 [lib.api.process] INFO: Successfully terminated process with pid 608.
2025-09-09 04:27:30,890 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-09-09 05:20:43,540 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:20:44,565 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:20:45,589 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:20:46,660 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:20:47,796 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:20:48,906 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:20:50,020 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:20:51,112 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:20:52,186 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:20:53,474 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:20:54,755 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:20:55,817 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:20:56,864 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:20:57,908 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:20:58,954 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:00,001 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:01,087 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:02,548 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:03,622 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:04,670 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:05,713 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:06,743 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:07,786 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:08,837 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:09,869 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:11,139 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:12,320 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:13,394 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:14,432 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:15,475 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:16,520 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:17,565 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:18,812 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:19,882 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:20,963 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:22,036 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:23,097 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:24,361 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:25,436 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:26,526 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:27,576 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:28,647 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:29,865 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:30,923 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:31,986 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:33,054 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:34,120 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:35,182 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:36,256 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:37,312 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:38,738 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:39,804 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:40,861 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:41,944 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:43,016 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:44,282 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:45,341 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:46,365 [cuckoo.core.scheduler] DEBUG: Task #6962657: no machine available yet
2025-09-09 05:21:47,395 [cuckoo.core.scheduler] INFO: Task #6962657: acquired machine win7x647 (label=win7x647)
2025-09-09 05:21:47,396 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.207 for task #6962657
2025-09-09 05:21:47,869 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 1155994 (interface=vboxnet0, host=192.168.168.207)
2025-09-09 05:22:05,299 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x647
2025-09-09 05:22:06,356 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x647 to vmcloak
2025-09-09 05:24:01,947 [cuckoo.core.guest] INFO: Starting analysis #6962657 on guest (id=win7x647, ip=192.168.168.207)
2025-09-09 05:24:02,953 [cuckoo.core.guest] DEBUG: win7x647: not ready yet
2025-09-09 05:24:08,063 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x647, ip=192.168.168.207)
2025-09-09 05:24:08,138 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x647, ip=192.168.168.207, monitor=latest, size=6660546)
2025-09-09 05:24:09,711 [cuckoo.core.resultserver] DEBUG: Task #6962657: live log analysis.log initialized.
2025-09-09 05:24:10,785 [cuckoo.core.resultserver] DEBUG: Task #6962657 is sending a BSON stream
2025-09-09 05:24:11,316 [cuckoo.core.resultserver] DEBUG: Task #6962657 is sending a BSON stream
2025-09-09 05:24:12,111 [cuckoo.core.resultserver] DEBUG: Task #6962657: File upload for 'shots/0001.jpg'
2025-09-09 05:24:12,139 [cuckoo.core.resultserver] DEBUG: Task #6962657 uploaded file length: 133472
2025-09-09 05:24:20,284 [cuckoo.core.resultserver] DEBUG: Task #6962657 is sending a BSON stream
2025-09-09 05:24:20,472 [cuckoo.core.resultserver] DEBUG: Task #6962657: File upload for 'shots/0002.jpg'
2025-09-09 05:24:20,484 [cuckoo.core.resultserver] DEBUG: Task #6962657 uploaded file length: 81584
2025-09-09 05:24:20,732 [cuckoo.core.resultserver] DEBUG: Task #6962657 is sending a BSON stream
2025-09-09 05:24:21,018 [cuckoo.core.resultserver] DEBUG: Task #6962657 is sending a BSON stream
2025-09-09 05:24:24,405 [cuckoo.core.guest] DEBUG: win7x647: analysis #6962657 still processing
2025-09-09 05:24:39,543 [cuckoo.core.guest] DEBUG: win7x647: analysis #6962657 still processing
2025-09-09 05:24:54,754 [cuckoo.core.guest] DEBUG: win7x647: analysis #6962657 still processing
2025-09-09 05:25:10,055 [cuckoo.core.guest] DEBUG: win7x647: analysis #6962657 still processing
2025-09-09 05:25:25,166 [cuckoo.core.guest] DEBUG: win7x647: analysis #6962657 still processing
2025-09-09 05:25:40,272 [cuckoo.core.guest] DEBUG: win7x647: analysis #6962657 still processing
2025-09-09 05:25:55,403 [cuckoo.core.guest] DEBUG: win7x647: analysis #6962657 still processing
2025-09-09 05:26:10,499 [cuckoo.core.guest] DEBUG: win7x647: analysis #6962657 still processing
2025-09-09 05:26:25,736 [cuckoo.core.guest] DEBUG: win7x647: analysis #6962657 still processing
2025-09-09 05:26:40,863 [cuckoo.core.guest] DEBUG: win7x647: analysis #6962657 still processing
2025-09-09 05:26:55,955 [cuckoo.core.guest] DEBUG: win7x647: analysis #6962657 still processing
2025-09-09 05:27:11,080 [cuckoo.core.guest] DEBUG: win7x647: analysis #6962657 still processing
2025-09-09 05:27:26,184 [cuckoo.core.guest] DEBUG: win7x647: analysis #6962657 still processing
2025-09-09 05:27:30,494 [cuckoo.core.resultserver] DEBUG: Task #6962657: File upload for 'curtain/1757384850.48.curtain.log'
2025-09-09 05:27:30,498 [cuckoo.core.resultserver] DEBUG: Task #6962657 uploaded file length: 36
2025-09-09 05:27:30,809 [cuckoo.core.resultserver] DEBUG: Task #6962657: File upload for 'sysmon/1757384850.8.sysmon.xml'
2025-09-09 05:27:30,878 [cuckoo.core.resultserver] DEBUG: Task #6962657 uploaded file length: 2393632
2025-09-09 05:27:30,889 [cuckoo.core.resultserver] DEBUG: Task #6962657: File upload for 'files/7c7f62b2d920ec56_task.bat'
2025-09-09 05:27:30,891 [cuckoo.core.resultserver] DEBUG: Task #6962657 uploaded file length: 136
2025-09-09 05:27:31,506 [cuckoo.core.resultserver] DEBUG: Task #6962657: File upload for 'shots/0003.jpg'
2025-09-09 05:27:31,528 [cuckoo.core.resultserver] DEBUG: Task #6962657 uploaded file length: 133471
2025-09-09 05:27:31,545 [cuckoo.core.resultserver] DEBUG: Task #6962657 had connection reset for <Context for LOG>
2025-09-09 05:27:32,217 [cuckoo.core.guest] INFO: win7x647: analysis completed successfully
2025-09-09 05:27:32,229 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-09-09 05:27:32,262 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-09-09 05:27:33,484 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x647 to path /srv/cuckoo/cwd/storage/analyses/6962657/memory.dmp
2025-09-09 05:27:33,486 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x647
2025-09-09 05:27:41,971 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.207 for task #6962657
2025-09-09 05:27:42,327 [cuckoo.core.scheduler] DEBUG: Released database task #6962657
2025-09-09 05:27:42,345 [cuckoo.core.scheduler] INFO: Task #6962657: analysis procedure completed

Signatures

Yara rules detected for file (10 events)
description (no description) rule GenerateTLSClientHelloPacket_Test
description Checks if being debugged rule anti_dbg
description Code injection with CreateRemoteThread in a remote process rule inject_thread
description Escalade priviledges rule escalate_priv
description Take screenshot rule screenshot
description Run a keylogger rule keylogger
description Affect system registries rule win_registry
description Affect system token rule win_token
description Affect private profile rule win_files_operation
description Affect hook table rule win_hook
Allocates read-write-execute memory (usually to unpack itself) (1 event)
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 608
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00380000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Queries for the computername (1 event)
Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: VPAMMTQMAZS
1 1 0
Command line console output was observed (7 events)
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: C:\Users\Administrator\AppData\Roaming\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: chcp
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\Administrator\AppData\Roaming\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: schtasks
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /create /tn "MalayamaraUpdate" /tr "'C:\Users\Administrator\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Active code page: 1251
console_handle: 0x00000013
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "MalayamaraUpdate" has successfully been created.
console_handle: 0x00000007
1 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)
section .itext
section .didata
The file contains an unknown PE resource name possibly indicative of a packer (1 event)
resource name VCLSTYLE
Creates executable files on the filesystem (1 event)
file C:\Users\Administrator\AppData\Roaming\Temp\Task.bat
Creates a suspicious process (1 event)
cmdline schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Administrator\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
Uses Windows utilities for basic Windows functionality (2 events)
cmdline schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Administrator\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
cmdline chcp 1251
Installs itself for autorun at Windows startup (1 event)
cmdline schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Administrator\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
File has been identified by 9 AntiVirus engine on IRMA as malicious (9 events)
G Data Antivirus (Windows) Virus: Gen:Variant.Ulise.472307 (Engine A)
Avast Core Security (Linux) Win32:MalwareX-gen [Drp]
WithSecure (Linux) Trojan.TR/Drop.Agent.ojaga
eScan Antivirus (Linux) Gen:Variant.Ulise.472307(DB)
Sophos Anti-Virus (Linux) Mal/Generic-S
DrWeb Antivirus (Linux) Trojan.DownLoad4.16266
Bitdefender Antivirus (Linux) Gen:Variant.Ulise.472307
Kaspersky Standard (Windows) HEUR:Trojan-Dropper.Win32.Agent.gen
Emsisoft Commandline Scanner (Windows) Gen:Variant.Ulise.472307 (B)
File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 events)
Bkav W32.Common.A7DB5B4A
Lionic Trojan.Win32.Drop.b!c
Skyhigh BehavesLike.Win32.Dropper.rh
ALYac Gen:Variant.Ulise.472307
Cylance Unsafe
VIPRE Gen:Variant.Ulise.472307
Sangfor Dropper.Win32.Malgent.Vnto
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Gen:Variant.Ulise.472307
K7GW Riskware ( 00584baa1 )
K7AntiVirus Riskware ( 00584baa1 )
Arcabit Trojan.Ulise.D734F3
VirIT Trojan.Win32.Genus.VAO
Symantec Trojan Horse
Elastic malicious (moderate confidence)
Avast Win32:DropperX-gen [Drp]
Kaspersky HEUR:Trojan-Dropper.Win32.Agent.gen
Alibaba TrojanDropper:Win32/Malgent.9f30f5f7
NANO-Antivirus Trojan.Win32.Drop.hnqzqi
MicroWorld-eScan Gen:Variant.Ulise.472307
Rising Dropper.Agent!8.2F (CLOUD)
Emsisoft Gen:Variant.Ulise.472307 (B)
F-Secure Trojan.TR/Drop.Agent.ojaga
DrWeb Trojan.DownLoad4.16266
Zillya Dropper.Agent.Win32.429537
TrendMicro TROJ_GEN.R002C0DAL25
McAfeeD ti!50A46B3120DA
CTX exe.trojan.generic
Sophos Mal/Generic-S
FireEye Gen:Variant.Ulise.472307
Jiangmin TrojanDropper.Agent.grwl
Webroot W32.Malware.Gen
Google Detected
Avira TR/Drop.Agent.ojaga
Antiy-AVL Trojan[Dropper]/Win32.Agent
Kingsoft Win32.Trojan-Dropper.Agent.gen
Gridinsoft Ransom.Win32.Wacatac.ca
Xcitium Malware@#xg8msxvtyhqb
Microsoft Trojan:Win32/Malgent!MSR
ViRobot Trojan.Win.Z.Agent.4979200
GData Gen:Variant.Ulise.472307
Varist W32/ABRisk.SFAA-7544
McAfee Artemis!5E94F0F6265F
DeepInstinct MALICIOUS
VBA32 TScope.Trojan.Delf
Malwarebytes Malware.AI.1282038740
Ikarus Trojan-Downloader.MSIL.Taily
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R002C0DAL25
Tencent Win32.Trojan-Dropper.Agent.Qwhl
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.