Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 31, 2021, 9:33 a.m.	May 31, 2021, 9:37 a.m.

Size	18.9MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`a1459b6cd648d10da05707b69166d2f6`
SHA256	`87ee5870a5c7a37b2a0b77e3394f02ff7563f7e7c0ed1a42c6b1bb5ea5e04d59`
CRC32	`1919AB39`
ssdeep	`393216:K2TZGNedccfAcSZ2wYHyBxUZ7os4TVYmHJ5vT9qgdoq1Vv:K2VGxwLSZ/aoskZHJ5vTcgdomv`
Yara	anti_vm_detect - Possibly employs anti-virtualization techniques Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)

Ls_Droid_v1.1.9.0.exe "C:\Users\test22\AppData\Local\Temp\Ls_Droid_v1.1.9.0.exe"
1896

Name	Response	Post-Analysis Lookup
tinywebdb.ls-droid.com	A 109.106.250.191	109.106.250.191
www.ls-droid.com	CNAME ls-droid.com A 109.106.250.191	109.106.250.191

IP Address	Status	Action
109.106.250.191	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49202 -> 109.106.250.191:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49202 109.106.250.191:443	C=US, ST=TX, L=Houston, O=cPanel, Inc., CN=cPanel, Inc. Certification Authority	CN=tinywebdb.ls-droid.com	79:5f:06:6f:03:30:57:a5:bd:e1:e0:0e:99:39:1e:dc:4d:f5:d8:4e

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 31, 2021, 9:33 a.m.			0	0
IsDebuggerPresent May 31, 2021, 9:33 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 31, 2021, 9:33 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section
section	.winlice
section	.boot

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ May 31, 2021, 9:33 a.m.	stacktrace: ls_droid_v1+0x2d38dd3 @ 0x3fb8dd3 ls_droid_v1+0x2d44a01 @ 0x3fc4a01 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 f1 4d 05 8d 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 3800704 registers.edi: 61603840 registers.eax: 3800704 registers.ebp: 3800784 registers.edx: 2130566132 registers.ebx: 32 registers.esi: 2000778283 registers.ecx: 4117757952	1
__exception__ May 31, 2021, 9:33 a.m.	stacktrace: exception.instruction_r: ed e9 48 ed 01 00 c3 e9 69 4f 01 00 d3 bd fe 09 exception.symbol: ls_droid_v1+0x2d98f6e exception.instruction: in eax, dx exception.module: Ls_Droid_v1.1.9.0.exe exception.exception_code: 0xc0000096 exception.offset: 47812462 exception.address: 0x4018f6e registers.esp: 3800824 registers.edi: 63480780 registers.eax: 1750617430 registers.ebp: 61603840 registers.edx: 22614 registers.ebx: 19398656 registers.esi: 63311622 registers.ecx: 20	1
__exception__ May 31, 2021, 9:33 a.m.	stacktrace: exception.instruction_r: ed e9 0b b3 01 00 50 6f f5 ff d0 9c 52 50 68 6a exception.symbol: ls_droid_v1+0x2d9111f exception.instruction: in eax, dx exception.module: Ls_Droid_v1.1.9.0.exe exception.exception_code: 0xc0000096 exception.offset: 47780127 exception.address: 0x401111f registers.esp: 3800824 registers.edi: 63480780 registers.eax: 1447909480 registers.ebp: 61603840 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 63311622 registers.ecx: 10	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header

suspicious_request

POST https://tinywebdb.ls-droid.com/testme.php

Performs some HTTP requests (1 event)

request

POST https://tinywebdb.ls-droid.com/testme.php

Sends data using the HTTP POST Method (1 event)

request

POST https://tinywebdb.ls-droid.com/testme.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 136 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a8b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a8b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7575c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7575d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757af000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755bf000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755c8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75483000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 31, 2021, 9:33 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

Ls_Droid_v1.1.9.0.exe tried to sleep 175 seconds, actually delayed analysis time by 175 seconds

Moves the original executable to a new location (1 event)

Time & API	Arguments	Status	Return	Repeated
MoveFileWithProgressW May 31, 2021, 9:33 a.m.	newfilepath_r: C:\Users\test22\AppData\Local\LSDroid_For_Windows\Ls_Droid_v1.1.9.0.exe_Url_pkbqrq5xkr0h4ks0zex3aqhujeiuyqdd\1.1.9.0\user.config flags: 1 oldfilepath_r: C:\Users\test22\AppData\Local\LSDroid_For_Windows\Ls_Droid_v1.1.9.0.exe_Url_pkbqrq5xkr0h4ks0zex3aqhujeiuyqdd\1.1.9.0\o3w05hak.newcfg newfilepath: C:\Users\test22\AppData\Local\LSDroid_For_Windows\Ls_Droid_v1.1.9.0.exe_Url_pkbqrq5xkr0h4ks0zex3aqhujeiuyqdd\1.1.9.0\user.config oldfilepath: C:\Users\test22\AppData\Local\LSDroid_For_Windows\Ls_Droid_v1.1.9.0.exe_Url_pkbqrq5xkr0h4ks0zex3aqhujeiuyqdd\1.1.9.0\o3w05hak.newcfg	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses May 31, 2021, 9:33 a.m.	flags: 1158 family: 0	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (4 events)

section

{u'size_of_data': u'0x00f26800', u'virtual_address': u'0x00002000', u'entropy': 7.931871074201835, u'name': u' ', u'virtual_size': u'0x0281e000'}

entropy

7.9318710742

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00006000', u'virtual_address': u'0x02820000', u'entropy': 7.949103184693326, u'name': u' ', u'virtual_size': u'0x0000de48'}

entropy

7.94910318469

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x003adc00', u'virtual_address': u'0x02e4e000', u'entropy': 7.960364805862479, u'name': u'.boot', u'virtual_size': u'0x003adc00'}

entropy

7.96036480586

description

A section with a high entropy has been found

entropy

0.997056089247

description

Overall entropy of this PE file is high

Checks for the presence of known windows from debuggers and forensic tools (50 out of 159 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA May 31, 2021, 9:33 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA May 31, 2021, 9:33 a.m.	class_name: Filemonclass window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Queries information on disks, possibly for anti-virtualization (3 events)

Time & API	Arguments	Status
NtCreateFile May 31, 2021, 9:33 a.m.	create_disposition: 1 (FILE_OPEN) file_handle: 0x000000f8 filepath: \??\PhysicalDrive0 desired_access: 0xc0100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 0 () filepath_r: \??\PhysicalDrive0 create_options: 96 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 1 (FILE_OPENED) share_access: 7 (FILE_SHARE_READ\|FILE_SHARE_WRITE\|FILE_SHARE_DELETE)	1
NtCreateFile May 31, 2021, 9:33 a.m.	create_disposition: 1 (FILE_OPEN) file_handle: 0x000000f8 filepath: \??\Scsi0: desired_access: 0xc0100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 0 () filepath_r: \??\Scsi0: create_options: 96 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 0 (FILE_SUPERSEDED) share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	1
DeviceIoControl May 31, 2021, 9:33 a.m.	input_buffer: SCSIDISK'2b703ec12 6ì0 BVXOH RADDS control_code: 315400 () device_handle: 0x000000f8 output_buffer: <INVALID POINTER>

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation May 31, 2021, 9:33 a.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 31, 2021, 9:33 a.m.	stacktrace: exception.instruction_r: ed e9 0b b3 01 00 50 6f f5 ff d0 9c 52 50 68 6a exception.symbol: ls_droid_v1+0x2d9111f exception.instruction: in eax, dx exception.module: Ls_Droid_v1.1.9.0.exe exception.exception_code: 0xc0000096 exception.offset: 47780127 exception.address: 0x401111f registers.esp: 3800824 registers.edi: 63480780 registers.eax: 1447909480 registers.ebp: 61603840 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 63311622 registers.ecx: 10	1	0	0

Generates some ICMP traffic

File has been identified by 31 AntiVirus engines on VirusTotal as malicious (31 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
Cylance	Unsafe
Sangfor	Trojan.Win32.Ymacco.AA87
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/XPACK.c7c8246d
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.43b818
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	FileRepMalware
ClamAV	Win.Packed.Zusy-9840502-0
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
Paloalto	generic.ml
McAfee-GW-Edition	Artemis
FireEye	Generic.mg.a1459b6cd648d10d
MaxSecure	Trojan.Malware.115473342.susgen
Avira	TR/Crypt.XPACK.Gen
Microsoft	Trojan:Win32/Ymacco.AA87
Gridinsoft	Trojan.Heur!.032100A1
AegisLab	Trojan.Win32.Generic.4!c
Cynet	Malicious (score: 99)
AhnLab-V3	Malware/Gen.RL_Reputation.R368523
McAfee	Artemis!A1459B6CD648
VBA32	BScope.Trojan.Caynamer
Rising	Trojan.Ymacco!8.11BE1 (CLOUD)
Ikarus	Trojan.Crypt
Fortinet	PossibleThreat.PALLAS.H
Webroot	W32.Malware.Gen
AVG	FileRepMalware
CrowdStrike	win/malicious_confidence_80% (W)

Ls_Droid_v1.1.9.0.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All