Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.13 04:11
hello.exe
11.13 03:11
espsemhvcioff.exe
11.13 02:11
Geek_se.exe
11.13 02:11
cred64.dll
11.13 02:11
svhost.exe
11.13 02:11
nb.exe
11.13 02:11
svcyr.exe
11.13 02:11
Ghost_1.5.11.5.exe
11.13 02:11
PowderGpl.exe
11.13 02:11
goodlabel%E6%89%93%E5%...

Latest News
11.15 03:11
Microfluidic Motors Co...
11.15 03:11
Novel ShrinkLocker ran...
11.15 03:11
Neuberger recommends c...
11.15 03:11
Outmaneuvering Rhysida...
11.15 02:11
The Intersection of Ma...
11.15 02:11
Revisiting Battery Safety
11.15 02:11
Diamond Sports Wins Ap...
11.15 02:11
From risks to resilien...
11.15 02:11
Newly patched Windows ...
11.15 02:11
Chinese targeting of U...

Summary | ZeroBOX

.svchost.exe

Generic Malware Malicious Packer UPX PE32 PE File

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 27, 2021, 9:12 a.m.	July 27, 2021, 9:25 a.m.

Size	265.1KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`264a4f1da5163ba11190d5b3cab35418`
SHA256	`49d777aff9d282095b6d8e7d26937d579869056e895c23efefbfea2775937f69`
CRC32	`B4FF52F1`
ssdeep	`1536:uOBaF/aHmFoeS2lM2JzIzntnTtO7KsaVsz6+9c6UpirYFYKW+:ueBeFyQzytnTtOGslz6p6BKf`
Yara	IsPE32 - (no description) Malicious_Packer_Zero - Malicious Packer Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature

.svchost.exe "C:\Users\test22\AppData\Local\Temp\.svchost.exe"
1896

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 27, 2021, 9:12 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d72000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 27, 2021, 9:12 a.m.	process_identifier: 1896 region_size: 57344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00590000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 27, 2021, 9:12 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x003f0000 process_handle: 0xffffffff	1	0	0

File has been identified by 16 AntiVirus engines on VirusTotal as malicious (16 events)

Lionic	Trojan.Win32.Vebzenpak.4!c
Cynet	Malicious (score: 100)
Sangfor	Trojan.Win32.Save.a
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/TrojanDownloader.Agent.FCS
APEX	Malicious
Kaspersky	Trojan.Win32.Vebzenpak.agcw
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
eGambit	Unsafe.AI_Score_99%
Microsoft	Trojan:Script/Phonzy.B!ml
AhnLab-V3	Trojan/Win32.Agent.C3559972
McAfee	Artemis!264A4F1DA516
Cylance	Unsafe
SentinelOne	Static AI - Suspicious PE
BitDefenderTheta	Gen:NN.ZevbaF.34050.qm1@aCGk!8bi