popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

updater.exe

Malicious Library UPX OS Processor Check PE64 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us April 2, 2023, 8:57 a.m. April 2, 2023, 9:02 a.m.
Size 3.9MB
Type PE32+ executable (console) x86-64, for MS Windows
MD5 a04a12bd76283170bc83848686e4f946
SHA256 13d6361137c3e50b65f6e7385e44e2a5bbcb435aea861112953579ec2230fd44
CRC32 E65E9FEC
ssdeep 98304:vT72zCNeI+sjbIBNmJ1t2WJ8BJXzN9Bhvu4:vPb+sjbIXgUJXzN9Bhvu4
PDB Path C:\Users\Admin\source\repos\dropper_my\x64\Release\dropper_my.pdb
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE64 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
pool.hashvault.pro
A 131.153.76.130
A 125.253.92.50
125.253.92.50
xmr.2miners.com
A 162.19.139.184
162.19.139.184
IP Address Status Action
131.153.76.130 Active Moloch
162.19.139.184 Active Moloch
164.124.101.2 Active Moloch
77.91.78.143 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2036289 ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) Crypto Currency Mining Activity Detected
UDP 192.168.56.103:50800 -> 164.124.101.2:53 2040353 ET INFO Observed DNS Query to Cryptocurrency Mining Pool Domain (xmr .2miners .com) Crypto Currency Mining Activity Detected
TCP 192.168.56.103:49167 -> 77.91.78.143:80 2035420 ET MALWARE Win32/Pripyat Activity (POST) A Network Trojan was detected
TCP 192.168.56.103:49169 -> 77.91.78.143:80 2035420 ET MALWARE Win32/Pripyat Activity (POST) A Network Trojan was detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.103:49164
131.153.76.130:443 		None None None
TLS 1.3
192.168.56.103:49168
162.19.139.184:12222 		None None None

pdb_path C:\Users\Admin\source\repos\dropper_my\x64\Release\dropper_my.pdb
section .00cfg
section _RDATA
suspicious_features Connection to IP address suspicious_request GET http://77.91.78.143/index.php?page=configurations&id=1
suspicious_features Connection to IP address suspicious_request GET http://77.91.78.143login.php
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://77.91.78.143/api/endpoint.php
request GET http://77.91.78.143/index.php?page=configurations&id=1
request GET http://77.91.78.143login.php
request POST http://77.91.78.143/api/endpoint.php
request POST http://77.91.78.143/api/endpoint.php
file C:\Users\Public\Videos\Provide.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\Public\Videos\Provide.exe
parameters:
filepath: C:\Users\Public\Videos\Provide.exe
1 1 0
section {u'size_of_data': u'0x003b3000', u'virtual_address': u'0x00036000', u'entropy': 7.997305020077126, u'name': u'.data', u'virtual_size': u'0x003b47a8'} entropy 7.99730502008 description A section with a high entropy has been found
entropy 0.944756204015 description Overall entropy of this PE file is high
host 77.91.78.143
file C:\Users\Public\Videos\Provide.exe
Lionic Trojan.Win32.Agent.Y!c
MicroWorld-eScan Trojan.GenericKD.66186725
FireEye Trojan.GenericKD.66186725
Cylance unsafe
CrowdStrike win/malicious_confidence_90% (W)
Symantec ML.Attribute.HighConfidence
Elastic malicious (moderate confidence)
ESET-NOD32 a variant of Win64/TrojanDropper.Agent.GW
Cynet Malicious (score: 100)
Paloalto generic.ml
Kaspersky Trojan.Win32.Agent.xavjgw
BitDefender Trojan.GenericKD.66186725
Avast Win64:Trojan-gen
Emsisoft Trojan.GenericKD.66186725 (B)
F-Secure Trojan.TR/Crypt.EPACK.Gen2
McAfee-GW-Edition BehavesLike.Win64.Generic.wc
Trapmine malicious.high.ml.score
Sophos Generic Reputation PUA (PUA)
Ikarus Trojan-Dropper.Win64.Agent
Avira TR/Crypt.EPACK.Gen2
Antiy-AVL Trojan/Win32.Wacatac
Microsoft Trojan:Win32/Wacatac.B!ml
Gridinsoft Trojan.Win64.Gen.bot
Arcabit Trojan.Generic.D3F1EDE5
ZoneAlarm Trojan.Win32.Agent.xavjgw
GData Trojan.GenericKD.66186725
Google Detected
McAfee Artemis!A04A12BD7628
MAX malware (ai score=86)
Malwarebytes Generic.Malware/Suspicious
Rising Dropper.Agent!8.2F (CLOUD)
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/PossibleThreat
AVG Win64:Trojan-gen