popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

tai1.exe

  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 April 12, 2021, 10:42 a.m. April 12, 2021, 10:58 a.m.
Size 681.9KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 83a82cacf8a42eb833b95c0985095457
SHA256 1efa74e72060865ff07bda90c4f5d0c470dd20198de7144960c88cef248c4457
CRC32 D8F6E251
ssdeep 12288:VoJqNIPtNmO6IOOEp0TMlja7NRl2PSVikIyoyueh+AkHcnLwuukoCOD6zlFjOz+2:VoJEKZ6IEGTMxapRl2PSwHTehy6BG+p4
Yara
  • network_http - Communications over HTTP
  • screenshot - Take screenshot
  • win_files_operation - Affect private profile
  • Str_Win32_Wininet_Library - Match Windows Inet API library declaration
  • Str_Win32_Internet_API - Match Windows Inet API call
  • Str_Win32_Http_API - Match Windows Http API call
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • IsPE32 - (no description)
  • IsWindowsGUI - (no description)
  • HasOverlay - Overlay Check
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check

Name Response Post-Analysis Lookup
prtboss.com
A 111.90.156.90
111.90.156.90
IP Address Status Action
111.90.156.90 Active Moloch
164.124.101.2 Active Moloch
172.217.25.14 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
suspicious_features POST method with no referer header suspicious_request POST http://prtboss.com/collect.php
request POST http://prtboss.com/collect.php
request POST http://prtboss.com/collect.php
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 232
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73772000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x000000c0
process_name: mobsync.exe
process_identifier: 7788
1 1 0

Process32NextW

 snapshot_handle: 0x000000c0
process_name: pw.exe
process_identifier: 3516
1 1 0

Process32NextW

 snapshot_handle: 0x000000c0
process_name: taskhost.exe
process_identifier: 6840
1 1 0

Process32NextW

 snapshot_handle: 0x000000c0
process_name: slui.exe
process_identifier: 7092
1 1 0

Process32NextW

 snapshot_handle: 0x000000c0
process_name: conhost.exe
process_identifier: 8024
1 1 0

Process32NextW

 snapshot_handle: 0x000000c0
process_name: tai1.exe
process_identifier: 232
1 1 0

Process32NextW

 snapshot_handle: 0x000000c0
process_name: pw.exe
process_identifier: 1520
1 1 0
host 172.217.25.14
file C:\wallet.dat
file C:\Users\test22\AppData\Roaming\Electrum\wallets
Time & API Arguments Status Return Repeated

RegSetValueExA

 key_handle: 0x00000250
regkey_r: ProxyEnable
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
1 0 0
file C:\Users\Default\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\Default User\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\Default\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\Public\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\Public\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\Default User\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\All Users\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\All Users\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\All Users\AppData\Roaming\.purple\accounts.xml
file C:\Users\Default User\AppData\Roaming\.purple\accounts.xml
file C:\Users\test22\AppData\Roaming\.purple\accounts.xml
file C:\Users\Default\AppData\Roaming\.purple\accounts.xml
file C:\Users\Public\AppData\Roaming\.purple\accounts.xml
Elastic malicious (high confidence)
DrWeb Trojan.PWS.Steam.18689
MicroWorld-eScan Gen:Variant.Stealer.7
FireEye Generic.mg.83a82cacf8a42eb8
Qihoo-360 Win32/TrojanSpy.Bobik.HgIASScA
ALYac Gen:Variant.Stealer.7
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
K7AntiVirus Spyware ( 005687121 )
Alibaba TrojanSpy:Win32/StellarStealer.d5e1f082
K7GW Spyware ( 005687121 )
Cybereason malicious.cf8a42
BitDefenderTheta Gen:NN.ZexaF.34670.QqY@aW0S6vo
Cyren W32/Trojan2.QDAM
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Spy.Agent.PYU
APEX Malicious
Avast Win32:PWSX-gen [Trj]
ClamAV Win.Malware.Zusy-9812688-0
Kaspersky HEUR:Trojan-Spy.Win32.Bobik.gen
BitDefender Gen:Variant.Stealer.7
NANO-Antivirus Trojan.Win32.Bobik.innsnn
Paloalto generic.ml
AegisLab Trojan.Win32.Bobik.l!c
Tencent Malware.Win32.Gencirc.10ce2a40
Ad-Aware Gen:Variant.Stealer.7
Emsisoft Trojan-Spy.Agent (A)
Zillya Trojan.Bobik.Win32.2070
McAfee-GW-Edition GenericRXMZ-DZ!83A82CACF8A4
Sophos ML/PE-A
Ikarus Trojan-Spy.Agent
Jiangmin TrojanSpy.Bobik.mi
Avira HEUR/AGEN.1141176
MAX malware (ai score=89)
Microsoft Trojan:Win32/StellarStealer.SBR!MSR
Gridinsoft Spy.Win32.Keylogger.oa!s1
Arcabit Trojan.Stealer.7
GData Win32.Trojan.PSE.3YNIAA
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.RL_Stealer.R355109
McAfee GenericRXMZ-DZ!83A82CACF8A4
VBA32 TrojanSpy.Bobik
Malwarebytes Generic.Trojan.Dropper.DDS
TrendMicro-HouseCall TROJ_GEN.R002C0DDA21
Rising Spyware.Agent!8.C6 (C64:YzY0OtP2hpfCUG2A)
Fortinet W32/GenKryptik.EZNX!tr
AVG Win32:PWSX-gen [Trj]
Panda Trj/GdSda.A
CrowdStrike win/malicious_confidence_70% (W)