Summary | ZeroBOX

rfl_01098752.exe

AsyncRAT AntiDebug PE File PE32 .NET EXE AntiVM
Category Machine Started Completed
FILE s1_win7_x6401 June 12, 2021, 12:41 p.m. June 12, 2021, 12:59 p.m.
Size 529.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 d2a8ef4a18e3c6dc377daf765b37a9ca
SHA256 931959c2c56185581ab2639948e3e207c5cb3c1e1c0225567c31f03a5b39e65d
CRC32 CE8900D2
ssdeep 12288:mQ985Wz2+Q38+VAYy2qoTGWA6Tp2x4tWKG1Gu7iTQezjBw5U1:c5MQ38tpsA6c4tc1Gu7Kzum1
Yara
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)

IP Address Status Action
164.124.101.2 Active Moloch
172.67.177.196 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49205 -> 172.67.177.196:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 172.67.177.196:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 172.67.177.196:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

suspicious_features GET method with no useragent header suspicious_request GET http://www.myfulfillmentproject.com/gw2/?JBZ8bVY=S4YPDuTGIFm1iVwFpCDQWmjwmifzQ/OJjUHdP/sl7N+U6VaEuPJRx7yqmJ3Hxab/NEMGoPlS&BXLtz=E2J4YjW0DTc
request GET http://www.myfulfillmentproject.com/gw2/?JBZ8bVY=S4YPDuTGIFm1iVwFpCDQWmjwmifzQ/OJjUHdP/sl7N+U6VaEuPJRx7yqmJ3Hxab/NEMGoPlS&BXLtz=E2J4YjW0DTc
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

process_identifier: 3020
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00970000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0007d200', u'virtual_address': u'0x00002000', u'entropy': 7.990204574161743, u'name': u'.text', u'virtual_size': u'0x0007d164'} entropy 7.99020457416 description A section with a high entropy has been found
entropy 0.964354527938 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
MicroWorld-eScan Trojan.GenericKD.37074552
FireEye Generic.mg.d2a8ef4a18e3c6dc
McAfee RDN/Generic.hbg
Cylance Unsafe
Sangfor Riskware.Win32.Agent.ky
K7AntiVirus Trojan ( 0057dd721 )
K7GW Trojan ( 0057dd721 )
CrowdStrike win/malicious_confidence_90% (W)
Cyren W32/MSIL_Kryptik.DZK.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/Kryptik.ABKG
APEX Malicious
Avast Win32:CrypterX-gen [Trj]
Kaspersky HEUR:Trojan-Spy.MSIL.Noon.gen
BitDefender Trojan.GenericKD.37074552
Paloalto generic.ml
Ad-Aware Trojan.GenericKD.37074552
Emsisoft Trojan.GenericKD.37074552 (B)
TrendMicro Trojan.MSIL.AGENTTESLA.USMANFA21
McAfee-GW-Edition Artemis!Trojan
MaxSecure Trojan.Malware.300983.susgen
Sophos Mal/Generic-S + Troj/Formbo-AJL
SentinelOne Static AI - Suspicious PE
Avira TR/Kryptik.kqxbi
MAX malware (ai score=82)
Kingsoft Win32.Troj.Undef.(kcloud)
Microsoft Trojan:MSIL/AgentTesla.AM!MTB
AegisLab Trojan.MSIL.Noon.l!c
ZoneAlarm HEUR:Trojan-Spy.MSIL.Noon.gen
GData Trojan.GenericKD.37074552
Cynet Malicious (score: 100)
ALYac Trojan.GenericKD.37074552
Malwarebytes MachineLearning/Anomalous.100%
TrendMicro-HouseCall Trojan.MSIL.AGENTTESLA.USMANFA21
Ikarus Win32.Outbreak
eGambit PE.Heur.InvalidSig
Fortinet PossibleThreat.PALLAS.H
AVG Win32:CrypterX-gen [Trj]
Cybereason malicious.d6e152