popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

1.exe

OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 12, 2021, 6:21 p.m. June 12, 2021, 6:24 p.m.
Size 761.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 5a3eb1ba34e04f53b7bc135578a1610b
SHA256 cf333d7bb01d28a0a43127cd5c86c8fdfa390c03565bc30fca6ea49b1ef0b7b6
CRC32 2B94A6DF
ssdeep 12288:Ncgz2j45iutNW/o8LudKs/90+cr5xq9FAfiMZp7qKblsIgFm8gdosZ5TguHaO+yz:Ncgz2j4/NytEp0+cr5xq0fiMZp776IZF
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
collector-node.us
A 172.67.143.39
A 104.21.46.235
172.67.143.39
collector-gate03.xyz
A 104.21.45.72
A 172.67.211.17
172.67.211.17
IP Address Status Action
104.21.45.72 Active Moloch
164.124.101.2 Active Moloch
172.67.143.39 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49201 -> 104.21.45.72:80 2027108 ET HUNTING Suspicious Zipped Filename in Outbound POST Request (screenshot.) M2 A Network Trojan was detected

Suricata TLS

No Suricata TLS

registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features POST method with no referer header suspicious_request POST http://collector-gate03.xyz/collect.php
request GET http://collector-node.us/u
request POST http://collector-gate03.xyz/collect.php
request POST http://collector-gate03.xyz/collect.php
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72af2000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x0000011c
process_name: pw.exe
process_identifier: 2540
1 1 0

Process32NextW

 snapshot_handle: 0x0000011c
process_name: mobsync.exe
process_identifier: 1068
1 1 0

Process32NextW

 snapshot_handle: 0x0000011c
process_name: taskhost.exe
process_identifier: 2036
1 1 0

Process32NextW

 snapshot_handle: 0x0000011c
process_name: 1.exe
process_identifier: 1080
1 1 0
file C:\wallet.dat
file C:\Users\test22\AppData\Roaming\Electrum\wallets
file C:\Users\Default\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\Default User\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\Default\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\Public\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\Public\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\Default User\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\All Users\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\All Users\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\All Users\AppData\Roaming\.purple\accounts.xml
file C:\Users\Default User\AppData\Roaming\.purple\accounts.xml
file C:\Users\test22\AppData\Roaming\.purple\accounts.xml
file C:\Users\Default\AppData\Roaming\.purple\accounts.xml
file C:\Users\Public\AppData\Roaming\.purple\accounts.xml
process 1.exe useragent JBJWN
process 1.exe useragent uploader
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
DrWeb Trojan.PWS.Siggen2.64821
MicroWorld-eScan Gen:Variant.Stealer.7
FireEye Generic.mg.5a3eb1ba34e04f53
McAfee GenericRXOM-OP!5A3EB1BA34E0
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
Cybereason malicious.a34e04
BitDefenderTheta Gen:NN.ZexaF.34738.VqW@auO7!xj
Cyren W32/Agent.CTW.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Spy.Agent.PYU
APEX Malicious
Avast Win32:PWSX-gen [Trj]
ClamAV Win.Malware.Zusy-9812688-0
Kaspersky HEUR:Trojan-Spy.Win32.Bobik.gen
BitDefender Gen:Variant.Stealer.7
NANO-Antivirus Trojan.Win32.Bobik.iunqoq
Rising Stealer.Agent!1.D401 (CLASSIC)
Ad-Aware Gen:Variant.Stealer.7
TACHYON Trojan-Spy/W32.Bobik.779776
Emsisoft Gen:Variant.Stealer.7 (B)
Zillya Trojan.Agent.Win32.2075725
McAfee-GW-Edition BehavesLike.Win32.Generic.bh
Sophos ML/PE-A
Ikarus Trojan-Spy.Racoon
Jiangmin TrojanSpy.Bobik.qz
MaxSecure Trojan.Malware.74196578.susgen
Avira HEUR/AGEN.1141176
Antiy-AVL Trojan/Generic.ASMalwS.32A7E89
Microsoft Trojan:Win32/Glupteba!ml
GData Win32.Trojan.PSE.MG6FVH
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.RL_Stealer.R355109
VBA32 TrojanSpy.Bobik
MAX malware (ai score=83)
Malwarebytes Spyware.PasswordStealer
Tencent Malware.Win32.Gencirc.10ce52dd
Yandex TrojanSpy.Agent!KdSyOWNBWz8
SentinelOne Static AI - Malicious PE
Fortinet W32/Agent.PYU!tr
AVG Win32:PWSX-gen [Trj]
Panda Trj/GdSda.A