popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

bitiki.exe

PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 6, 2021, 7:48 a.m. Aug. 6, 2021, 7:50 a.m.
Size 1.4MB
Type PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5 8d3a5bd971302039d6c8c1feadbb2921
SHA256 40ec98b570a94ad97200616b1bbb955d0aaa1f6edb5b26150ee73422c7d801f1
CRC32 D4F92700
ssdeep 24576:undRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkzGgSaLKT0sk2:IXDFBU2iIBb0xY/6sUYYbgj
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
888myrat.duckdns.org
A 78.189.177.240
78.189.177.240
IP Address Status Action
164.124.101.2 Active Moloch
78.189.177.240 Active Moloch

domain 888myrat.duckdns.org
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1684
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ca2000
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00170a00', u'virtual_address': u'0x00272000', u'entropy': 7.936660184957146, u'name': u'UPX1', u'virtual_size': u'0x00171000'} entropy 7.93666018496 description A section with a high entropy has been found
entropy 0.999661016949 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeShutdownPrivilege
1 1 0
section UPX0 description Section name indicates UPX
section UPX1 description Section name indicates UPX
section UPX2 description Section name indicates UPX
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 8 (SystemProcessorPerformanceInformation)
1 0 0
description bitiki.exe tried to sleep 8184943 seconds, actually delayed analysis time by 8184940 seconds
Time & API Arguments Status Return Repeated

SetWindowsHookExW

 thread_identifier: 0
callback_function: 0x0050f84a
hook_identifier: 14 (WH_MOUSE_LL)
module_address: 0x00000000
1 6292037 0
Time & API Arguments Status Return Repeated

SetWindowsHookExW

 thread_identifier: 0
callback_function: 0x004ca8cc
hook_identifier: 13 (WH_KEYBOARD_LL)
module_address: 0x00000000
1 2883853 0
dead_host 78.189.177.240:5000
Bkav W32.CautusL.Trojan
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Graftor.833606
CAT-QuickHeal Trojan.GenericRI.S20702303
McAfee GenericRXAA-FA!8D3A5BD97130
Cylance Unsafe
K7AntiVirus Trojan ( 00569d2a1 )
K7GW Trojan ( 00569d2a1 )
Cybereason malicious.971302
Arcabit Trojan.Graftor.DCB846
Cyren W32/Injector.A.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Agent.ACBZ
APEX Malicious
ClamAV Win.Malware.Mikey-9819889-0
Kaspersky HEUR:Trojan-Spy.Win32.Solmyr.vho
BitDefender Gen:Variant.Graftor.833606
NANO-Antivirus Trojan.Win32.Solmyr.ixdyob
Avast Win32:RATX-gen [Trj]
Ad-Aware Gen:Variant.Graftor.833606
Sophos Mal/Generic-S
DrWeb Trojan.Siggen14.19963
Zillya Trojan.Solmyr.Win32.230
McAfee-GW-Edition BehavesLike.Win32.Generic.tc
FireEye Generic.mg.8d3a5bd971302039
Emsisoft Gen:Variant.Graftor.833606 (B)
SentinelOne Static AI - Suspicious PE
Jiangmin TrojanSpy.Solmyr.be
Avira TR/Crypt.ULPM.Gen
MAX malware (ai score=89)
Antiy-AVL Trojan/Generic.ASMalwS.33CD62C
Microsoft Backdoor:Win32/ParalaxRat.STD
GData Win32.Trojan.PSE.13NZCK2
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Gen.Reputation.C4261324
BitDefenderTheta AI:Packer.DF79F53F1E
ALYac Gen:Variant.Graftor.833606
TACHYON Trojan-Spy/W32.Solmyr.3943424
VBA32 TrojanSpy.Solmyr
Malwarebytes Trojan.MalPack
Tencent Malware.Win32.Gencirc.10ce6d4b
Yandex Trojan.Agent!mpJSPmzsnqA
Ikarus Trojan.MalPack
eGambit Unsafe.AI_Score_96%
Fortinet W32/Agent.ACBZ!tr
MaxSecure Trojan.Malware.300983.susgen
AVG Win32:RATX-gen [Trj]
Panda Trj/GdSda.A
Qihoo-360 HEUR/QVM11.1.053B.Malware.Gen