Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 28, 2023, 2:05 p.m.	July 28, 2023, 2:09 p.m.

Size	89.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`7480f4019e4d41ea6508ce29adab0d2c`
SHA256	`7fd202241c96488dd41d5749f4d29b5f480d7b659e1e795eb29f2e27475b8bb1`
CRC32	`4B6C1FFF`
ssdeep	`1536:FuON8V8ybtiqY2bpxLW9woUsScAbcauNhV2ZszsWuKcdJU2aI89p:FuhVZbtvbpxLHoUsYuNhV25LJU2aI89p`
PDB Path	D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) Admin_Tool_IN_Zero - Admin Tool Sysinternals Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Win_Amadey_Zero - Amadey bot IsPE32 - (no description)

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
2136
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,Main
2220
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
1000
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,
2320

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 28, 2023, 2:05 p.m.			0	0
IsDebuggerPresent July 28, 2023, 2:05 p.m.			0	0
IsDebuggerPresent July 28, 2023, 2:05 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb

Allocates read-write-execute memory (usually to unpack itself) (9 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 28, 2023, 2:05 p.m.	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744df000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2023, 2:05 p.m.	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2023, 2:05 p.m.	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2023, 2:05 p.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744df000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2023, 2:05 p.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2023, 2:05 p.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2023, 2:05 p.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744df000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2023, 2:05 p.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2023, 2:05 p.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 events)

Bkav	W32.NataDecoAAT.Trojan
Lionic	Trojan.Win32.Agent.Y!c
Cynet	Malicious (score: 99)
CAT-QuickHeal	Trojan.GenericPMF.S29595454
ALYac	Gen:Variant.Zusy.446682
Malwarebytes	Amadey.Trojan.Downloader.DDS
Zillya	Trojan.Sdum.Win32.9748
Sangfor	Trojan.Win32.Amadey.Vatm
K7AntiVirus	Riskware ( 00584baa1 )
Alibaba	Trojan:Win32/Amadey.cd02c4f0
K7GW	Riskware ( 00584baa1 )
CrowdStrike	win/malicious_confidence_100% (W)
VirIT	Trojan.Win32.Genus.NMA
Cyren	W32/Agent.GPBN-4848
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	Win32/Agent.AFGA
APEX	Malicious
ClamAV	Win.Malware.Zusy-10001339-0
Kaspersky	HEUR:Trojan.Win32.Agent.gen
BitDefender	Gen:Variant.Zusy.446682
NANO-Antivirus	Trojan.Win32.Clipper.juivsg
ViRobot	Trojan.Win.Z.Agent.91136.GC
MicroWorld-eScan	Gen:Variant.Zusy.446682
Avast	Win32:BotX-gen [Trj]
Rising	Trojan.Generic@AI.100 (RDML:UOvjVOFWo3+5kBV55m4AZg)
TACHYON	Trojan/W32.Agent.91136.ADV
Emsisoft	Gen:Variant.Zusy.446682 (B)
F-Secure	Heuristic.HEUR/AGEN.1301048
DrWeb	Trojan.ClipSpy.85
VIPRE	Gen:Variant.Zusy.446682
TrendMicro	TROJ_GEN.R03BC0DDN23
McAfee-GW-Edition	Trojan-FUUW!7480F4019E4D
FireEye	Gen:Variant.Zusy.446682
Sophos	Troj/Amadey-K
Ikarus	Trojan.Win32.Amadey
GData	Win32.Trojan.Amadey.C
Jiangmin	Trojan.Agent.ejvu
Avira	HEUR/AGEN.1301048
Antiy-AVL	Trojan[Backdoor]/Win32.Convagent
Arcabit	Trojan.Zusy.D6D0DA
SUPERAntiSpyware	Trojan.Agent/Gen-Kryptik
ZoneAlarm	HEUR:Trojan.Win32.Agent.gen
Microsoft	Trojan:Win32/Amadey!ic
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R572736
McAfee	Trojan-FUUW!7480F4019E4D
MAX	malware (ai score=80)
VBA32	Trojan.Sdum
Cylance	unsafe

clip64.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All