sysinfo.exe
Glary Utilities SystemInformation file version info
Program on Windows 3 known copies with hashes 2 Sigma rules name it
Is it the real sysinfo.exe?
Installed in
C:\Program Files (x86)\Glary Utilities 5\Signed byGlarysoft LTD
ProductGlary Utilities, Glarysoft Ltd
DescriptionGlary Utilities SystemInformation
3 known copies
5.0.0.23 · C:\Program Files (x86)\Glary Utilities 5\sysinfo.exe · signed by Glarysoft LTD
84508275784ce149870fc61032afd3de11ede255ddda1cae53e3eaf404116bdf5.0.0.22 · C:\program files (x86)\Glary Utilities 5\sysinfo.exe · signed by Glarysoft LTD
dcdb33cee4605d0bb3631a9b32cb67bb7f276be412fe67ec17b8372926c9acad5.0.0.21 · C:\Program Files (x86)\Glary Utilities 5\sysinfo.exe · signed by Glarysoft LTD
473dd49e0cb8b6102a58ba40513f1bff1183cb5324ebb02d48fc5508dad559e0From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson