popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

4493ZRgdFTeXSMAHoJWWJBvXxPsJ.exe

Gen1 UPX Malicious Library Malicious Packer PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 22, 2023, 8:44 a.m. April 22, 2023, 8:51 a.m.
Size 474.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2252417dd70ee414c21fc4585940b6fd
SHA256 c73171952a210537b7d9ef3155ee1df312c2ab1a9d84883db96c44863885625f
CRC32 CA0277D5
ssdeep 12288:EP1M+5sUj035Ur2kF23qxwIH6dPrkyguLNPWJTi0or6a:ESesUj+5S2kF2axudPrkIt0or
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library

Name Response Post-Analysis Lookup
t.me
A 149.154.167.99
149.154.167.99
steamcommunity.com
A 104.75.41.21
104.75.41.21
IP Address Status Action
104.75.41.21 Active Moloch
149.154.167.99 Active Moloch
164.124.101.2 Active Moloch
195.201.44.125 Active Moloch
95.216.164.28 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49163 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 149.154.167.99:443 -> 192.168.56.101:49164 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49163 -> 149.154.167.99:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49163 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 192.168.56.101:49166 -> 104.75.41.21:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49174 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 192.168.56.101:49175 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 192.168.56.101:49174 -> 149.154.167.99:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49175 -> 149.154.167.99:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49174 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 192.168.56.101:49175 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 149.154.167.99:443 -> 192.168.56.101:49176 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49178 -> 104.75.41.21:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49161 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 192.168.56.101:49161 -> 149.154.167.99:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49161 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 192.168.56.101:49161 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 192.168.56.101:49175 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 192.168.56.101:49174 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 192.168.56.101:49163 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49166
104.75.41.21:443 		C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Extended Validation Server CA unknown=US, unknown=Washington, unknown=Private Organization, serialNumber=602 290 773, C=US, ST=Washington, L=Bellevue, O=Valve Corp, CN=store.steampowered.com b1:30:5e:4c:ee:14:70:87:a7:d7:1c:77:07:b5:3c:2c:99:13:aa:c5
TLSv1
192.168.56.101:49178
104.75.41.21:443 		C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Extended Validation Server CA unknown=US, unknown=Washington, unknown=Private Organization, serialNumber=602 290 773, C=US, ST=Washington, L=Bellevue, O=Valve Corp, CN=store.steampowered.com b1:30:5e:4c:ee:14:70:87:a7:d7:1c:77:07:b5:3c:2c:99:13:aa:c5

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section fre832s
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
4493zrgdftexsmahojwwjbvxxpsj+0x7aa2 @ 0x367aa2
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: cc 9b eb 09 b8 01 00 00 00 c3 8b 65 e8 c7 45 fc
exception.symbol: 4493zrgdftexsmahojwwjbvxxpsj+0x2a46
exception.instruction: int3
exception.module: 4493ZRgdFTeXSMAHoJWWJBvXxPsJ.exe
exception.exception_code: 0x80000003
exception.offset: 10822
exception.address: 0x362a46
registers.esp: 2227632
registers.edi: 100
registers.eax: 0
registers.ebp: 2227700
registers.edx: 2130566132
registers.ebx: 2130567168
registers.esi: 201
registers.ecx: 2094661632
1 0 0

__exception__

 stacktrace: 
4493zrgdftexsmahojwwjbvxxpsj+0x2a5f @ 0x362a5f
4493zrgdftexsmahojwwjbvxxpsj+0x7aa2 @ 0x367aa2
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: cc eb 0e b8 01 00 00 00 c3 8b 65 e8 e8 45 ff ff
exception.symbol: 4493zrgdftexsmahojwwjbvxxpsj+0x28fa
exception.instruction: int3
exception.module: 4493ZRgdFTeXSMAHoJWWJBvXxPsJ.exe
exception.exception_code: 0x80000003
exception.offset: 10490
exception.address: 0x3628fa
registers.esp: 2227584
registers.edi: 0
registers.eax: 2227608
registers.ebp: 2227624
registers.edx: 0
registers.ebx: 0
registers.esi: 3549776
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
4493zrgdftexsmahojwwjbvxxpsj+0x290b @ 0x36290b
4493zrgdftexsmahojwwjbvxxpsj+0x2a5f @ 0x362a5f
4493zrgdftexsmahojwwjbvxxpsj+0x7aa2 @ 0x367aa2
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: cc eb 0e b8 01 00 00 00 c3 8b 65 e8 e8 45 fd ff
exception.symbol: 4493zrgdftexsmahojwwjbvxxpsj+0x288a
exception.instruction: int3
exception.module: 4493ZRgdFTeXSMAHoJWWJBvXxPsJ.exe
exception.exception_code: 0x80000003
exception.offset: 10378
exception.address: 0x36288a
registers.esp: 2227536
registers.edi: 0
registers.eax: 2227560
registers.ebp: 2227576
registers.edx: 0
registers.ebx: 0
registers.esi: 3549443
registers.ecx: 0
1 0 0
request GET https://steamcommunity.com/profiles/76561199476091435
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2568
region_size: 466944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2568
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00480000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2568
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00490000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2568
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00520000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2568
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00530000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2568
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00540000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2568
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00550000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2568
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00570000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2568
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00580000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0005c400', u'virtual_address': u'0x0001d000', u'entropy': 7.999203729489272, u'name': u'fre832s', u'virtual_size': u'0x0005d000'} entropy 7.99920372949 description A section with a high entropy has been found
entropy 0.780126849894 description Overall entropy of this PE file is high
host 195.201.44.125
host 95.216.164.28
process 4493ZRgdFTeXSMAHoJWWJBvXxPsJ.exe useragent Mozilla/5.0 (Windows NT 10.0; x64 rv:107.0) Gecko / 20100101 Firefox / 107.0
process 4493ZRgdFTeXSMAHoJWWJBvXxPsJ.exe useragent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
Bkav W32.AIDetect.malware1
Lionic Trojan.Win32.Vidar.4!c
Elastic malicious (high confidence)
DrWeb Trojan.PWS.Steam.34705
MicroWorld-eScan Trojan.GenericKD.66549324
McAfee GenericRXVL-CM!2252417DD70E
Malwarebytes Trojan.Crypt.Generic
Zillya Trojan.Vidar.Win32.474
Sangfor Infostealer.Win32.Vidar.Vrhz
CrowdStrike win/malicious_confidence_100% (W)
Alibaba TrojanPSW:Win32/Vidar.be493b26
K7GW Trojan ( 005a16541 )
K7AntiVirus Trojan ( 005a16541 )
Arcabit Trojan.Generic.D3F7764C
BitDefenderTheta Gen:NN.ZexaF.36164.Dy0@auv0R9ei
VirIT Trojan.Win32.GenusT.DGBW
Cyren W32/ABRisk.QSFW-4458
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Kryptik.HSTO
Cynet Malicious (score: 100)
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan-PSW.Win32.Vidar.gen
BitDefender Trojan.GenericKD.66549324
NANO-Antivirus Trojan.Win32.Vidar.juvrsl
Avast Win32:PWSX-gen [Trj]
Tencent Malware.Win32.Gencirc.10bea0e9
Emsisoft Trojan.GenericKD.66549324 (B)
F-Secure Trojan.TR/Crypt.Agent.lwryu
VIPRE Gen:Variant.Zusy.449076
TrendMicro TrojanSpy.Win32.VIDAR.YXDDTZ
McAfee-GW-Edition GenericRXVL-CM!2252417DD70E
FireEye Generic.mg.2252417dd70ee414
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
Jiangmin Trojan.PSW.Vidar.qf
Webroot W32.Trojan.Gen
Avira TR/Crypt.Agent.lwryu
MAX malware (ai score=86)
Antiy-AVL Trojan/Win32.GenKryptik
Gridinsoft Spy.Win32.Vidar.bot
Xcitium Malware@#3ghgyspkmb8a
Microsoft Trojan:Win32/Vidar.MAN!MTB
ViRobot Trojan.Win.Z.Vidar.485376.B
ZoneAlarm HEUR:Trojan-PSW.Win32.Vidar.gen
GData Win32.Trojan-Stealer.Arkei.7WNFK8
Google Detected
AhnLab-V3 Trojan/Win.PWS.C5379969
Acronis suspicious
VBA32 TrojanPSW.Vidar
dead_host 95.216.164.28:80
dead_host 192.168.56.101:49167
dead_host 192.168.56.101:49179
dead_host 195.201.44.125:80