popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

P49A1RKQbr6n5L2G.zip

ZIP Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 March 9, 2023, 6:10 p.m. March 9, 2023, 6:14 p.m.
Size 864.5KB
Type Zip archive data, at least v2.0 to extract
MD5 5ed137665b139baccce1abee74282b81
SHA256 45efd63ea476b6cb9c7fa9a8f1428475f4dfb5516b77dc4f8d1d6a4af70af553
CRC32 95116FCE
ssdeep 6144:n0ODy+y5fPfnMe6OKYn02Fyrkw6ppGN8OoZf0cK2/KEPi9WR:nE+y5UeQ6okw6WN8OoOcv/KEPn
Yara
  • zip_file_format - ZIP file format

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
103.132.242.26 Active Moloch
104.168.155.143 Active Moloch
164.124.101.2 Active Moloch
164.90.222.65 Active Moloch
167.172.199.165 Active Moloch
182.162.143.56 Active Moloch
183.111.227.137 Active Moloch
187.63.160.88 Active Moloch
66.228.32.31 Active Moloch
72.15.201.15 Active Moloch
91.121.146.47 Active Moloch
91.207.28.33 Active Moloch

ESET-NOD32 a variant of Win64/GenKryptik.GHDZ
Kaspersky UDS:Trojan-Banker.Win64.Emotet.cmtd
Baidu Archive.Bomb
TrendMicro TrojanSpy.Win64.EMOTET.SMA
MAX malware (ai score=82)
VBA32 suspected of Archive.MailBomb
Rising Malware.SwollenFile!1.DDB4 (CLASSIC)
host 103.132.242.26
host 104.168.155.143
host 164.90.222.65
host 167.172.199.165
host 182.162.143.56
host 183.111.227.137
host 187.63.160.88
host 66.228.32.31
host 72.15.201.15
host 91.121.146.47
host 91.207.28.33
dead_host 72.15.201.15:8080
dead_host 91.207.28.33:8080
dead_host 164.90.222.65:443
dead_host 192.168.56.102:49195
dead_host 192.168.56.102:49193
dead_host 104.168.155.143:8080
dead_host 183.111.227.137:8080