File name:

AntiPublic.zip

Full analysis: https://app.any.run/tasks/d20bed2f-71c9-4375-8790-d37644529b41
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Analysis date: September 17, 2019, 13:45:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
azorult
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

9E936E6BE4DEBDC473C917BFD4CC8DF6

SHA1:

503B38EA4B96AA025BE963BA1C36432231129915

SHA256:

8C3E0C8F8A2E23A9AEF45E65C5F027771ED652F548B8907E6AA5731F7B05D099

SSDEEP:

24576:llfmtBoVjv0Barxn9HrRT3JFpNwL1OeSTXgVDeG/7:lJ6uv0BalnR9JFYJOev5bD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • AntiPublic.exe (PID: 3044)
      • AntiPublic.exe (PID: 3068)
      • AntiPublic.exe (PID: 3156)
      • AntiPublic.exe (PID: 2320)
      • ConsoleRegChecker.exe (PID: 2912)
      • AntiPublic Updater.exe (PID: 2492)
      • AntiPublic.exe (PID: 3312)
      • AntiPublic.exe (PID: 1344)
      • AntiPublic Updater.exe (PID: 684)
      • AntiPublic.exe (PID: 664)
    • Connects to CnC server

      • AntiPublic.exe (PID: 3068)
      • AntiPublic.exe (PID: 3156)
    • AZORULT was detected

      • AntiPublic.exe (PID: 3068)
      • AntiPublic.exe (PID: 3156)
    • Loads dropped or rewritten executable

      • ConsoleRegChecker.exe (PID: 2912)
      • AntiPublic Updater.exe (PID: 2492)
      • AntiPublic.exe (PID: 3312)
      • AntiPublic.exe (PID: 1344)
      • AntiPublic Updater.exe (PID: 684)
      • AntiPublic.exe (PID: 664)
    • Downloads executable files from the Internet

      • AntiPublic Updater.exe (PID: 2492)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3016)
      • AntiPublic Updater.exe (PID: 2492)
      • WinRAR.exe (PID: 3096)
    • Application launched itself

      • AntiPublic.exe (PID: 3044)
      • AntiPublic.exe (PID: 2320)
    • Creates files in the user directory

      • AntiPublic.exe (PID: 3068)
    • Reads Environment values

      • AntiPublic.exe (PID: 3312)
      • AntiPublic.exe (PID: 1344)
      • AntiPublic.exe (PID: 664)
    • Starts Internet Explorer

      • AntiPublic.exe (PID: 1344)
      • AntiPublic Updater.exe (PID: 684)
    • Executed via COM

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2084)
  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2988)
      • iexplore.exe (PID: 3288)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2052)
      • iexplore.exe (PID: 2988)
      • iexplore.exe (PID: 2236)
    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 2052)
    • Application launched itself

      • iexplore.exe (PID: 2988)
    • Creates files in the user directory

      • iexplore.exe (PID: 2052)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2084)
    • Reads internet explorer settings

      • iexplore.exe (PID: 2052)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 2988)
      • iexplore.exe (PID: 3288)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2018:05:26 00:12:04
ZipCRC: 0xc96ee4a8
ZipCompressedSize: 12185
ZipUncompressedSize: 28160
ZipFileName: AltoControls.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
17
Malicious processes
12
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start drop and start drop and start start drop and start drop and start winrar.exe antipublic.exe no specs #AZORULT antipublic.exe consoleregchecker.exe no specs antipublic.exe no specs #AZORULT antipublic.exe antipublic updater.exe antipublic.exe antipublic.exe iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs antipublic updater.exe iexplore.exe no specs iexplore.exe winrar.exe antipublic.exe

Process information

PID
CMD
Path
Indicators
Parent process
664"C:\Users\admin\AppData\Local\Temp\Rar$EXa3096.27282\AntiPublic.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3096.27282\AntiPublic.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3096.27282\antipublic.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
684"C:\Users\admin\AppData\Local\Temp\Rar$EXa3016.24780\AntiPublic Updater.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3016.24780\AntiPublic Updater.exe
WinRAR.exe
User:
admin
Company:
Newtonsoft
Integrity Level:
MEDIUM
Description:
Json.NET
Exit code:
0
Version:
9.0.1.19813
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3016.24780\antipublic updater.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1344"C:\Users\admin\AppData\Local\Temp\Rar$EXa3016.19552\AntiPublic.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3016.19552\AntiPublic.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3016.19552\antipublic.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2052"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2988 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2084C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exesvchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Exit code:
0
Version:
26,0,0,131
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_26_0_0_131_activex.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2236"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3288 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2320"C:\Users\admin\AppData\Local\Temp\Rar$EXa3016.12356\AntiPublic.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3016.12356\AntiPublic.exeWinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3016.12356\antipublic.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2492"C:\Users\admin\AppData\Local\Temp\Rar$EXa3016.17039\AntiPublic Updater.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3016.17039\AntiPublic Updater.exe
WinRAR.exe
User:
admin
Company:
Newtonsoft
Integrity Level:
MEDIUM
Description:
Json.NET
Exit code:
0
Version:
9.0.1.19813
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3016.17039\antipublic updater.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2912"C:\Users\admin\AppData\Local\Temp\Rar$EXa3016.12063\ConsoleRegChecker.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3016.12063\ConsoleRegChecker.exeWinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
ConsoleRegChecker
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3016.12063\consoleregchecker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2988"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
AntiPublic.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 747
Read events
2 517
Write events
226
Delete events
4

Modification events

(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3016) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\AntiPublic.zip
(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
58
Suspicious files
5
Text files
97
Unknown types
26

Dropped files

PID
Process
Filename
Type
3016WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3016.48931\en\AntiPublic.resources.dllexecutable
MD5:
SHA256:
3016WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3016.48931\AntiPublic.exeexecutable
MD5:
SHA256:
3016WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3016.12063\en\AntiPublic.resources.dllexecutable
MD5:
SHA256:
3016WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3016.48931\Newtonsoft.Json.dllexecutable
MD5:5AFDA7C7D4F7085E744C2E7599279DB3
SHA256:F58C374FFCAAE4E36D740D90FBF7FE70D0ABB7328CD9AF3A0A7B70803E994BA4
3016WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3016.48931\AltoControls.dllexecutable
MD5:B581A0648CE87B6E293E45A87D02C4A1
SHA256:3252DC102E53EE98CEEE6B5945AD2A9A552831C581EEAD76BD22C30C5C2633D5
3016WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3016.48931\GemBox.Email.dllexecutable
MD5:3657F2F4783FC9D9505B8C137AABA060
SHA256:A5899F6D6C6F3944DEC97CA32B4A915606EE7154ABCEC29020AF3C21AE9B3274
3016WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3016.48931\GemBox.Email.xmlxml
MD5:8655FDE8790C59D030ADEB2785272E11
SHA256:50E6A3EFB27C484E370F35BDD1441520AE9C5642277E0B62CB3B42AE7D6A1146
3016WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3016.48931\ru-RU\AntiPublic.resources.dllexecutable
MD5:523B1F726C98B6F45D7E3D785AC0FC38
SHA256:E27D305EFC4EB3B3387FD02A7BE6D857E54F537F54A7158E0C17B40CFE8CDB2D
3016WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3016.12063\AltoControls.dllexecutable
MD5:B581A0648CE87B6E293E45A87D02C4A1
SHA256:3252DC102E53EE98CEEE6B5945AD2A9A552831C581EEAD76BD22C30C5C2633D5
3016WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3016.48931\AntiPublic Updater.exeexecutable
MD5:6CAE94E55820679E220B859ADB2A8984
SHA256:228B01F9078EA70737E17F75D08567B92AB9D226899D63116FA407CBF34C0350
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
36
DNS requests
10
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3312
AntiPublic.exe
GET
200
144.76.190.197:80
http://myrz.org/api/check.php?key=c94bbf3863c96496ab5b87455ee699a1&plus=1
DE
text
96 b
whitelisted
3312
AntiPublic.exe
GET
200
144.76.190.197:80
http://myrz.org/api/check.php?key=c94bbf3863c96496ab5b87455ee699a1&plus=1
DE
text
96 b
whitelisted
1344
AntiPublic.exe
GET
200
144.76.190.197:80
http://myrz.org/api/check_updates.php?do=version
DE
text
18 b
whitelisted
3312
AntiPublic.exe
GET
200
144.76.190.197:80
http://myrz.org/api/check.php?key=c94bbf3863c96496ab5b87455ee699a1&plus=1
DE
text
96 b
whitelisted
1344
AntiPublic.exe
GET
200
144.76.190.197:80
http://myrz.org/api/check.php?key=c94bbf3863c96496ab5b87455ee699a1&plus=1
DE
text
96 b
whitelisted
1344
AntiPublic.exe
GET
200
144.76.190.197:80
http://myrz.org/api/check.php?key=c94bbf3863c96496ab5b87455ee699a1&plus=1
DE
text
96 b
whitelisted
664
AntiPublic.exe
GET
200
144.76.190.197:80
http://myrz.org/api/check.php?key=c94bbf3863c96496ab5b87455ee699a1&plus=1
DE
text
96 b
whitelisted
684
AntiPublic Updater.exe
GET
200
144.76.190.197:80
http://myrz.org/check_updates.php
DE
text
79 b
whitelisted
664
AntiPublic.exe
GET
200
144.76.190.197:80
http://myrz.org/api/check.php?key=c94bbf3863c96496ab5b87455ee699a1&plus=1
DE
text
96 b
whitelisted
2236
iexplore.exe
GET
200
144.76.190.197:80
http://myrz.org/AntiPublic.zip
DE
compressed
677 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3312
AntiPublic.exe
144.76.190.197:80
myrz.org
Hetzner Online GmbH
DE
suspicious
1344
AntiPublic.exe
144.76.190.197:80
myrz.org
Hetzner Online GmbH
DE
suspicious
2988
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2052
iexplore.exe
178.32.0.172:443
lolzteam.net
OVH SAS
FR
unknown
2052
iexplore.exe
216.58.207.42:443
fonts.googleapis.com
Google Inc.
US
whitelisted
2052
iexplore.exe
172.217.22.99:443
fonts.gstatic.com
Google Inc.
US
whitelisted
2052
iexplore.exe
88.212.201.207:443
counter.yadro.ru
United Network LLC
RU
unknown
2052
iexplore.exe
151.101.112.193:443
i.imgur.com
Fastly
US
malicious
2988
iexplore.exe
178.32.0.172:443
lolzteam.net
OVH SAS
FR
unknown
684
AntiPublic Updater.exe
144.76.190.197:80
myrz.org
Hetzner Online GmbH
DE
suspicious

DNS requests

Domain
IP
Reputation
tembumgo.pw
  • 87.236.16.223
malicious
myrz.org
  • 144.76.190.197
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
lolzteam.net
  • 178.32.0.172
  • 178.32.0.175
  • 145.239.119.46
  • 178.32.0.173
  • 145.239.119.47
  • 178.32.0.174
whitelisted
fonts.googleapis.com
  • 216.58.207.42
whitelisted
code.jquery.com
  • 205.185.208.52
whitelisted
fonts.gstatic.com
  • 172.217.22.99
whitelisted
i.imgur.com
  • 151.101.112.193
malicious
counter.yadro.ru
  • 88.212.201.207
  • 88.212.196.77
  • 88.212.196.104
  • 88.212.201.208
  • 88.212.201.195
  • 88.212.196.72
  • 88.212.196.122
  • 88.212.201.205
  • 88.212.196.69
  • 88.212.196.101
  • 88.212.201.194
  • 88.212.196.105
  • 88.212.201.197
  • 88.212.196.103
  • 88.212.196.123
  • 88.212.201.199
  • 88.212.196.75
  • 88.212.196.124
  • 88.212.201.196
  • 88.212.196.102
  • 88.212.201.193
  • 88.212.196.66
whitelisted
mc.yandex.ru
  • 87.250.250.119
  • 93.158.134.119
  • 77.88.21.119
  • 87.250.251.119
whitelisted

Threats

PID
Process
Class
Message
1060
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.pw domain - Likely Hostile
3068
AntiPublic.exe
A Network Trojan was detected
AV TROJAN Azorult CnC Beacon
3068
AntiPublic.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult.Stealer HTTP Header
3068
AntiPublic.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult Request
3068
AntiPublic.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.pw domain
3156
AntiPublic.exe
A Network Trojan was detected
AV TROJAN Azorult CnC Beacon
3156
AntiPublic.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult.Stealer HTTP Header
3156
AntiPublic.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult Request
3156
AntiPublic.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.pw domain
2492
AntiPublic Updater.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2 ETPRO signatures available at the full report
No debug info