Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 25, 2021, 10:56 a.m.	Sept. 25, 2021, 10:59 a.m.

Size	1.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`3146709a424c7546aa78d89159618da8`
SHA256	`7a5a953b328eddffbd69d55bc2d6626c353bcef9a9a9f4efec49cdaa7ac601ac`
CRC32	`0FFC9050`
ssdeep	`24576:vtbjtrDHCMuhiGazgrPNpuNUVL2r7cFhI8PRNdmaMdk0vT3ek:VjZTCiGacPNpKg9mDL`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

Name	Response	Post-Analysis Lookup
mas.to	A 88.99.75.82	88.99.75.82

IP Address	Status	Action
164.124.101.2	Active	Moloch
88.99.75.82	Active	Moloch

Flow	SID	Signature	Category
UDP 192.168.56.101:61479 -> 164.124.101.2:53	2027757	ET DNS Query for .to TLD	Potentially Bad Traffic
UDP 192.168.56.101:61479 -> 8.8.8.8:53	2027757	ET DNS Query for .to TLD	Potentially Bad Traffic
TCP 192.168.56.101:49199 -> 88.99.75.82:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49201 -> 88.99.75.82:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 88.99.75.82:443 -> 192.168.56.101:49202	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: exception.instruction_r: 8a 08 40 3a cb 75 f9 2b c2 50 56 b9 5c 10 4d 00 exception.symbol: file8+0x106e0 exception.instruction: mov cl, byte ptr [eax] exception.module: file8.exe exception.exception_code: 0xc0000005 exception.offset: 67296 exception.address: 0x4106e0 registers.esp: 1637032 registers.edi: 0 registers.eax: 0 registers.ebp: 16 registers.edx: 1 registers.ebx: 0 registers.esi: 0 registers.ecx: 1637060	1	0	0

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2232 region_size: 1323008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01dd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 1323008 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1	0	0

Lionic	Trojan.Multi.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Fugrafa.166459
FireEye	Generic.mg.3146709a424c7546
ALYac	Gen:Variant.Fugrafa.166459
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Fugrafa.D28A3B
BitDefenderTheta	Gen:NN.ZexaF.34170.tvW@ay7LHmii
Symantec	Infostealer.Predapa!gm
APEX	Malicious
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Fugrafa.166459
Avast	FileRepMetagen [Malware]
Rising	Trojan.Generic@ML.87 (RDML:GeQnmO8V9GTiFOzRWtxpag)
Ad-Aware	Gen:Variant.Fugrafa.166459
Sophos	ML/PE-A + Mal/EncPk-APW
McAfee-GW-Edition	BehavesLike.Win32.Emotet.tm
Emsisoft	Gen:Variant.Fugrafa.166459 (B)
SentinelOne	Static AI - Suspicious PE
Webroot	W32.Trojan.Gen
MAX	malware (ai score=85)
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Microsoft	PWS:Win32/Predator.RTA!MTB
GData	Gen:Variant.Fugrafa.166459
Cynet	Malicious (score: 100)
McAfee	Artemis!3146709A424C
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Kryptik.HMLF!tr
AVG	FileRepMetagen [Malware]

file8.exe