Summary | ZeroBOX

dgeApp17.exe

AsyncRAT Socket DNS PWS AntiDebug PE File PE32 .NET EXE AntiVM
Category Machine Started Completed
FILE s1_win7_x6401 June 12, 2021, 1:03 p.m. June 12, 2021, 1:10 p.m.
Size 443.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 81f63c8e0fab4d42de5486e88aa5ac74
SHA256 2c4029189010085712385bb7329bf0a10851ddec9c9849e60a94962896fcdfe4
CRC32 4C67375A
ssdeep 12288:g4tWKG1Gu7iTQezjBwpxutyAHPusCNzkw/U1:g4tc1Gu7KzupxRKuL581
Yara
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
209.141.34.39 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

1 1 0
suspicious_features POST method with no referer header, HTTP version 1.0 used, Connection to IP address suspicious_request POST http://209.141.34.39/cap-01/pin.php
request POST http://209.141.34.39/cap-01/pin.php
request POST http://209.141.34.39/cap-01/pin.php
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Login Data
file C:\Users\test22\AppData\Local\Chromium\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data
file C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Login Data
file C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Time & API Arguments Status Return Repeated

MoveFileWithProgressW

newfilepath_r: C:\Users\test22\AppData\Roaming\41D896\6D6F4D.exe
flags: 1
oldfilepath_r: C:\Users\test22\AppData\Local\Temp\dgeapp17.exe
newfilepath: C:\Users\test22\AppData\Roaming\41D896\6D6F4D.exe
oldfilepath: C:\Users\test22\AppData\Local\Temp\dgeApp17.exe
1 1 0
section {u'size_of_data': u'0x00067800', u'virtual_address': u'0x00002000', u'entropy': 7.98912034795837, u'name': u'.text', u'virtual_size': u'0x00067634'} entropy 7.98912034796 description A section with a high entropy has been found
entropy 0.957225433526 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0
url http://www.ibsensoftware.com/
description Communications use DNS rule Network_DNS
description Communications over RAW Socket rule Network_TCP_Socket
description Win32 PWS Loki rule Win32_PWS_Loki_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
host 209.141.34.39
file C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml
file C:\Users\test22\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini
file C:\Users\test22\AppData\Roaming\wcx_ftp.ini
file C:\Windows\wcx_ftp.ini
file C:\Users\test22\wcx_ftp.ini
file C:\Windows\32BitFtp.ini
file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Program Files (x86)\FileZilla\Filezilla.xml
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\test22\AppData\Roaming\FileZilla\filezilla.xml
registry HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry HKEY_CURRENT_USER\Software\Martin Prikryl
registry HKEY_LOCAL_MACHINE\Software\Martin Prikryl
file C:\Users\test22\AppData\Roaming\.purple\accounts.xml
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook
MicroWorld-eScan Trojan.GenericKD.37078319
FireEye Generic.mg.81f63c8e0fab4d42
McAfee RDN/Generic BackDoor
Cylance Unsafe
Sangfor Backdoor.MSIL.Androm.gen
K7AntiVirus Trojan ( 0057ddc11 )
BitDefender Trojan.GenericKD.37078319
K7GW Trojan ( 0057ddc11 )
Cybereason malicious.b57e01
Arcabit Trojan.Generic.D235C52F
Cyren W32/MSIL_Agent.BCR.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/Kryptik.ABKG
APEX Malicious
Avast Win32:TrojanX-gen [Trj]
Kaspersky HEUR:Backdoor.MSIL.Androm.gen
Alibaba Trojan:MSIL/Kryptik.7fb5bda7
AegisLab Trojan.MSIL.Androm.m!c
Ad-Aware Trojan.GenericKD.37078319
Comodo TrojWare.Win32.Agent.duygu@0
DrWeb Trojan.PackedNET.835
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_FRS.0NA103FB21
McAfee-GW-Edition Artemis!Trojan
Emsisoft Trojan.Crypt (A)
Webroot W32.Trojan.Gen
Avira TR/Kryptik.kojhw
Kingsoft Win32.Hack.Undef.(kcloud)
Gridinsoft Trojan.Win32.Kryptik.oa
Microsoft Trojan:MSIL/Tnega.SS!MTB
GData Trojan.GenericKD.37078319
Cynet Malicious (score: 100)
AhnLab-V3 Infostealer/Win.Agent.R425155
BitDefenderTheta Gen:NN.ZemsilF.34738.Bm2@aupdZt
MAX malware (ai score=100)
Malwarebytes Trojan.MalPack.MSIL
Zoner Trojan.Win32.112719
TrendMicro-HouseCall TROJ_FRS.0NA103FB21
Ikarus Trojan.Inject
eGambit PE.Heur.InvalidSig
Fortinet MSIL/Kryptik.ABKG!tr
AVG Win32:TrojanX-gen [Trj]
Paloalto generic.ml
CrowdStrike win/malicious_confidence_90% (W)
MaxSecure Trojan.Malware.300983.susgen