CmdID

CmdID / Files

WinSCP.exe

WinSCP: SFTP, FTP, WebDAV, S3 and SCP client file version info

Program on Windows 2 known copies with hashes 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real WinSCP.exe?

file version info and known copies
Installed inC:\Program Files (x86)\WinSCP\
Signed byMartin Prikryl
ProductWinSCP, Martin Prikryl
DescriptionWinSCP: SFTP, FTP, WebDAV, S3 and SCP client

2 known copies

5.19.4.11829 · C:\Program Files (x86)\WinSCP\WinSCP.exe · signed by Martin Prikryl

d3683beca3a40574e5fd68d30451137e4a8bbaca8c428ebb781d565d6a70385e

5.17.7.10640 · C:\Program Files (x86)\WinSCP\WinSCP.exe · signed by Martin Prikryl

424505953e12c975d18eb5c0d51efd79d11bb3a18423af0098042b9abe7243fc

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name WinSCP.exe
mediumFTP Connection Open Attempt Via Winscp CLIfrack113
mediumWinscp Execution From Non Standard Folderfrack113

Sigma names WinSCP.exe in 3 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.