Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 25, 2021, 9:58 a.m.	June 25, 2021, 10:14 a.m.

Size	375.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`91e2c066da101bdb8cbfae83d90a15cf`
SHA256	`161a1eb003a6ee20d635879514a3be9feb2f2d126214a7bbeb8e93daa11e4a49`
CRC32	`FFD9EB3F`
ssdeep	`6144:ORjbUHOvGUNIE/FDjBazqjWgR+MSEtvlZTONpRGX5B4PY3mA0O0Gp8NhE5Jod:ejbh9tDjiuT+xEtl0u4w3mAZyld`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

s%CE%BDchost.exe "C:\Users\test22\AppData\Local\Temp\s%CE%BDchost.exe"
2948
- cmd.exe C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\test22\AppData\Local\Temp\S%CE%B~1.EXE > nul
  2056
  - PING.EXE ping -n 2 127.0.0.1
    492

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
121.4.183.54	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 25, 2021, 9:58 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

PAGE

The executable uses a known packer (1 event)

packer

Armadillo v1.71

Allocates read-write-execute memory (usually to unpack itself) (10 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory June 25, 2021, 9:58 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72bb1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 25, 2021, 9:58 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x77371000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 25, 2021, 9:58 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b91000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 25, 2021, 9:58 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b81000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 25, 2021, 9:58 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b61000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 25, 2021, 9:58 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76891000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 25, 2021, 9:58 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b41000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 25, 2021, 9:58 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10001000 process_handle: 0xffffffff		3221225713
NtProtectVirtualMemory June 25, 2021, 9:58 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 331776 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10151000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 25, 2021, 9:58 a.m.	process_identifier: 492 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73321000 process_handle: 0xffffffff	1	0

Creates a service (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceA June 25, 2021, 9:58 a.m.	service_start_name: start_type: 2 password: display_name: Windows·þÎñÖ÷½ø³Ì filepath: C:\Windows\System32\sﾦￍchost.exe -auto service_name: s¦Íchost.exe filepath_r: C:\Windows\system32\s¦Íchost.exe -auto desired_access: 18 service_handle: 0x00605620 error_control: 0 service_type: 16 service_manager_handle: 0x006056c0	1	6313504	0

Creates a suspicious process (1 event)

cmdline

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\test22\AppData\Local\Temp\S%CE%B~1.EXE > nul

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\s%CE%BDchost.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0005d400', u'virtual_address': u'0x00002000', u'entropy': 7.87533214787007, u'name': u'.data', u'virtual_size': u'0x0005d394'}

entropy

7.87533214787

description

A section with a high entropy has been found

entropy

0.997326203209

description

Overall entropy of this PE file is high

Yara rule detected in process memory (9 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	ping -n 2 127.0.0.1
cmdline	C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\test22\AppData\Local\Temp\S%CE%B~1.EXE > nul

Communicates with host for which no DNS query was performed (1 event)

host

121.4.183.54

Installs itself for autorun at Windows startup (1 event)

service_name

s¦Íchost.exe

service_path

C:\Windows\System32\sﾦￍchost.exe -auto

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2948 resumed a thread in remote process 2056
NtResumeThread June 25, 2021, 9:58 a.m.	thread_handle: 0x00000174 suspend_count: 1 process_identifier: 2056	1	0	0

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader30.28282
MicroWorld-eScan	Gen:Variant.Zusy.313935
FireEye	Generic.mg.91e2c066da101bdb
CAT-QuickHeal	Backdoor.FarfliPMF.S19352949
McAfee	Trojan-FRMW!91E2C066DA10
Cylance	Unsafe
Zillya	Trojan.GenKryptik.Win32.36169
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0055a5d81 )
Alibaba	Backdoor:Win32/GhostRAT.af85ac6d
K7GW	Trojan ( 0055a5d81 )
Cybereason	malicious.6da101
BitDefenderTheta	Gen:NN.ZexaF.34758.xmW@a0gar3n
Cyren	W32/Agent.BOB.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenKryptik.EZKJ
APEX	Malicious
Avast	Win32:BackdoorX-gen [Trj]
ClamAV	Win.Trojan.Farfli-9645812-0
Kaspersky	HEUR:Backdoor.Win32.Farfli.vho
BitDefender	Gen:Variant.Zusy.313935
NANO-Antivirus	Trojan.Win32.Farfli.gethzp
Paloalto	generic.ml
AegisLab	Trojan.Win32.Farfli.m!c
Tencent	Malware.Win32.Gencirc.10b0922c
Ad-Aware	Gen:Variant.Zusy.313935
Sophos	ML/PE-A + Troj/AutoG-KM
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0DFG21
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
Emsisoft	Gen:Variant.Zusy.313935 (B)
Ikarus	Trojan.Win32.Krypt
Jiangmin	Backdoor.Farfli.exu
Avira	BDS/Farfli.xrlrm
MAX	malware (ai score=89)
Antiy-AVL	Trojan/Generic.ASMalwS.2C8A853
Microsoft	Trojan:Win32/GhostRAT
GData	Gen:Variant.Zusy.313935
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.RL_Farfli.R299612
Acronis	suspicious
ALYac	Gen:Variant.Zusy.313935
TACHYON	Backdoor/W32.Farfli.384000
VBA32	Trojan.Injuke
Malwarebytes	Backdoor.Ghost
Zoner	Trojan.Win32.105885
TrendMicro-HouseCall	TROJ_GEN.R002C0DFG21
Rising	Trojan.Win32.FakeFolder.ae (CLASSIC)

s%CE%BDchost.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All