853rat_c1bc60587353e61f9ed04b1269eb0afb_jpg_2019-09-03_18_30.txt

* ID: 853
* MalFamily: "Malicious"

* MalScore: 10.0

* File Name: "rat_c1bc60587353e61f9ed04b1269eb0afb.jpg"
* File Size: 1064960
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
* SHA256: "fa9a94b32f7fa1e1e3eef63d3fb9003fda8d295e1f1a3e521691725e4c7da9f3"
* MD5: "c1bc60587353e61f9ed04b1269eb0afb"
* SHA1: "b8fa6fbd4d3d08c2a8b89460c9e7fd4e7094d962"
* SHA512: "1ec653c03b257bfe1ba5fb08890d861d78bbc106fccb60668f007cfa5c28765eaeab7ee163f63c240387bcb2c240df42f029a4fafc18be59bbba1ceaa9718e0e"
* CRC32: "3A83E124"
* SSDEEP: "12288:3Mr6y90gD5M+gpgHDEkaNr4KhhbRG+0nrjrl+5cPFSqE+2Oy:Ny1adpylaVy+mZ+CMqE+25"

* Process Execution:

* Executed Commands:

* Signatures Detected:

        "Description": "File has been identified by 14 Antiviruses on VirusTotal as malicious",
        "Details":

                "FireEye": "Generic.mg.c1bc60587353e61f"


                "Cylance": "Unsafe"


                "Cybereason": "malicious.d4d3d0"


                "Invincea": "heuristic"


                "APEX": "Malicious"


                "F-Secure": "Trojan.TR/Dropper.Gen"


                "Paloalto": "generic.ml"


                "Jiangmin": "Trojan-PSW.Azorult.b"


                "Avira": "TR/Dropper.Gen"


                "Antiy-AVL": "TrojanArcBomb/Win32.Agent"


                "Endgame": "malicious (moderate confidence)"


                "Ikarus": "Trojan-Spy.Agent"


                "AVG": "FileRepMetagen Malware"


                "Qihoo-360": "HEUR/QVM20.1.A4BB.Malware.Gen"





* Started Service:

* Mutexes:

* Modified Files:

* Deleted Files:

* Modified Registry Keys:

* Deleted Registry Keys:

* DNS Communications:

* Domains:

* Network Communication - ICMP:

* Network Communication - HTTP:

* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: