popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

x-8.6.blaze

ELF AntiVM AntiDebug
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 14, 2023, 9:05 a.m. Aug. 14, 2023, 9:08 a.m.
Size 117.0KB
Type ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, not stripped
MD5 69a84378087813dcc137688a49871166
SHA256 e4a89d0596681b36ca880374a28e3728211ec1b69d25216225b83930852c06d0
CRC32 F161F581
ssdeep 3072:7Q18wxy7OyHnK6Ptg1tIOU/bVNgCpha1Fc9S8j0R5e2mEJe6/:9wI7dHpFOiOUjzppha1Fc9/j0R5e2mEh
Yara
  • IsELF - Executable and Linking Format executable file (Linux/Unix)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
file C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file c:\program files\mozilla firefox\firefox.exe
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x744b0000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x741a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x743a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74521000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x740a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74371000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75291000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x726e1000
process_handle: 0xffffffff
1 0 0
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EditPlus.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Chrome.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\Word 2013.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\displayswitch.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeShutdownPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeShutdownPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeShutdownPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeShutdownPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeShutdownPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeShutdownPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeShutdownPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeShutdownPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
registry HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\EDITPLUS.EXE
registry HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Mozilla Thunderbird\Capabilities\Hidden
Elastic Linux.Trojan.Gafgyt
MicroWorld-eScan Gen:Variant.Trojan.Linux.Gafgyt.9
VIPRE Gen:Variant.Trojan.Linux.Gafgyt.9
Sangfor Suspicious.Linux.Save.a
Arcabit Trojan.Trojan.Linux.Gafgyt.9
Cyren E64/Mirai.BE.gen!Camelot
Symantec Linux.Mirai
ESET-NOD32 a variant of Linux/Gafgyt.AZG
TrendMicro-HouseCall Backdoor.Linux.GAFGYT.SMMR4
Avast ELF:Agent-AYQ [Trj]
ClamAV Unix.Dropper.Mirai-7138855-0
Kaspersky HEUR:Backdoor.Linux.Gafgyt.bj
BitDefender Gen:Variant.Trojan.Linux.Gafgyt.9
Emsisoft Gen:Variant.Trojan.Linux.Gafgyt.9 (B)
F-Secure Exploit.EXP/ELF.Gafgyt.Gen.I
DrWeb Linux.Siggen.9999
TrendMicro Backdoor.Linux.GAFGYT.SMMR4
FireEye Gen:Variant.Trojan.Linux.Gafgyt.9
Sophos Linux/DDoS-CIA
SentinelOne Static AI - Malicious ELF
GData Gen:Variant.Trojan.Linux.Gafgyt.9
Google Detected
Avira EXP/ELF.Gafgyt.Gen.I
Microsoft Backdoor:Linux/DemonBot.Aa!MTB
ZoneAlarm HEUR:Backdoor.Linux.Gafgyt.bj
Avast-Mobile ELF:Gafgyt-KS [Trj]
Cynet Malicious (score: 99)
AhnLab-V3 Linux/Gafgyt.Gen44
BitDefenderTheta Gen:NN.Mirai.36350
ALYac Gen:Variant.Trojan.Linux.Gafgyt.9
MAX malware (ai score=87)
Rising Backdoor.Mirai/Linux!1.E352 (CLASSIC)
Ikarus Trojan.Linux.Gafgyt
MaxSecure Trojan.Malware.121218.susgen
AVG ELF:Agent-AYQ [Trj]