popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

ss29

Gen1 Generic Malware UPX Malicious Library Malicious Packer PE64 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 16, 2023, 4:15 p.m. April 16, 2023, 4:37 p.m.
Size 566.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 1a370e0c814e4444b9f0669ef7e92e3d
SHA256 bc4a5e1104914d5167f3fc238047673a5918fa013dd22db812d87f4390a5dd38
CRC32 C94BCF32
ssdeep 6144:DqJiPjw6mMS8YkTIbaH1MHxMrUxKHu/i5uzq46uOh4kcSfWBvgba3V30ytVJfecn:UgMHxMlu//zFXOh4kDYIWEOxUL0uH6N
PDB Path spinstall.pdb
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • Generic_Malware_Zero - Generic Malware
  • Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • IsPE64 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
bz.bbbeioaag.com
A 103.100.211.218
103.100.211.218
count.iiagjaggg.com
A 154.221.31.191
154.221.31.191
www.facebook.com
CNAME star-mini.c10r.facebook.com
A 157.240.31.35
157.240.31.35
IP Address Status Action
103.100.211.218 Active Moloch
154.221.31.191 Active Moloch
157.240.31.35 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49165 -> 154.221.31.191:80 2003626 ET HUNTING Double User-Agent (User-Agent User-Agent) Potentially Bad Traffic
TCP 192.168.56.101:49164 -> 157.240.31.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49164
157.240.31.35:443 		C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com f4:81:be:d8:fb:b5:af:14:40:10:62:49:8d:5d:b8:26:b6:47:f1:65

registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
pdb_path spinstall.pdb
resource name MUI
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
0x2db9b14
0x24e880

exception.instruction_r: 48 8b 01 ff 50 18 48 8b 43 10 40 32 ed 40 38 68
exception.instruction: mov rax, qword ptr [rcx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x2db9b14
registers.r14: 0
registers.r15: 0
registers.rcx: 0
registers.rsi: 0
registers.r10: 47906816
registers.rbx: 2418816
registers.rsp: 914704
registers.r11: -9151031864016699136
registers.r8: 2
registers.r9: 48598888
registers.rdx: 915800
registers.r12: 0
registers.rbp: 914944
registers.rdi: 915800
registers.rax: 915800
registers.r13: 1
1 0 0
request GET http://bz.bbbeioaag.com/sts/cimage.jpg
request GET http://count.iiagjaggg.com/check/safe
request GET https://www.facebook.com/ads/manager/account_settings/account_billing
request GET https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fads%2Fmanager%2Faccount_settings%2Faccount_billing
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 1495040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002c40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 1232896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002db0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 58\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 38\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 72\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 81\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 47\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 41\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 56\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 32\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 19\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 30\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 22\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 95\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 70\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 28\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 94\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 68\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 90\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 29\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 91\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 10\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 96\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 46\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 89\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 100\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 66\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 98\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 75\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 86\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 87\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 14\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 82\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 43\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 77\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 61\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 2\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 104\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 67\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 7\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 53\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 33\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 102\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 34\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 99\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 16\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 71\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 42\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 54\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 60\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 24\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 48\Network\Cookies
ESET-NOD32 a variant of Win64/TrojanDownloader.Agent_AGen.BU
Paloalto generic.ml
Kaspersky UDS:DangerousObject.Multi.Generic
Avast FileRepMalware [Misc]
DrWeb Trojan.DownLoader45.54381
McAfee-GW-Edition Artemis!Trojan
ZoneAlarm Trojan.Win32.Fabookie.bno
McAfee Artemis!1A370E0C814E
AVG FileRepMalware [Misc]
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0