Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 5, 2023, 8:36 a.m.	Sept. 5, 2023, 8:38 a.m.

Size	13.9MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`db4801f350f32e49f20e81ddba0e91a6`
SHA256	`8d14350bfc8be918b5a0d74859036eb57030dd3b121df779b98343d7bd2a476a`
CRC32	`92F314D0`
ssdeep	`196608:eZ/lOqPnih8FXj+hYeB0sKYu/PaQhKDnO8NpHzgsAGKaRZtG77CT05hrtqlKuiXj:BqPnLFCjQ8DOETgsv/GvkI6KDs0Mfk`
Yara	Malicious_Library_Zero - Malicious_Library OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature ASPack_Zero - ASPack packed file IsPE64 - (no description)

main.exe "C:\Users\test22\AppData\Local\Temp\main.exe"
184
- main.exe "C:\Users\test22\AppData\Local\Temp\main.exe"
  2196

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 5, 2023, 8:28 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

_RDATA

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 5, 2023, 8:28 a.m.	stacktrace: 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 0x7fef7c97ef8 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x7fef7c97ef8 registers.r14: 0 registers.r15: 196974 registers.rcx: 196974 registers.rsi: 1 registers.r10: 196974 registers.rbx: 0 registers.rsp: 4090888 registers.r11: 0 registers.r8: 1 registers.r9: 0 registers.rdx: 28 registers.r12: 0 registers.rbp: 9802912 registers.rdi: 0 registers.rax: 4090992 registers.r13: 28	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Sept. 5, 2023, 8:28 a.m.

stacktrace:

0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x7fef7c97ef8
registers.r14: 0
registers.r15: 196974
registers.rcx: 196974
registers.rsi: 1
registers.r10: 196974
registers.rbx: 0
registers.rsp: 4090888
registers.r11: 0
registers.r8: 1
registers.r9: 0
registers.rdx: 28
registers.r12: 0
registers.rbp: 9802912
registers.rdi: 0
registers.rax: 4090992
registers.r13: 28

Creates executable files on the filesystem (11 events)

file	C:\Users\test22\AppData\Local\Temp\_MEI1842\python310.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI1842\sqlite3.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI1842\libssl-1_1.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI1842\libffi-7.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI1842\pywin32_system32\pywintypes310.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI1842\pywin32_system32\pythoncom310.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI1842\VCRUNTIME140.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI1842\mfc140u.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI1842\python3.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI1842\libcrypto-1_1.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI1842\VCRUNTIME140_1.dll

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x0000f600', u'virtual_address': u'0x00052000', u'entropy': 7.555572206814071, u'name': u'.rsrc', u'virtual_size': u'0x0000f498'}

entropy

7.55557220681

description

A section with a high entropy has been found

File has been identified by 39 AntiVirus engines on VirusTotal as malicious (39 events)

Bkav	W32.AIDetectMalware.64
Lionic	Trojan.Win32.Shelm.tseF
Elastic	malicious (high confidence)
MicroWorld-eScan	Generic.Trojan.Stealer.D.369F589F
McAfee	Artemis!DB4801F350F3
Malwarebytes	Agent.Spyware.Stealer.DDS
VIPRE	Generic.Trojan.Stealer.D.369F589F
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Generic.Trojan.Stealer.D.369F589F
Arcabit	Generic.Trojan.Stealer.D.369F589F
Cyren	W64/PY_Stealer.A.gen!Eldorado
Symantec	Infostealer
Cynet	Malicious (score: 100)
Kaspersky	UDS:DangerousObject.Multi.Generic
Alibaba	TrojanSpy:Win64/Disin.55686a7e
Avast	Python:Agent-IR [Trj]
Emsisoft	Generic.Trojan.Stealer.D.369F589F (B)
DrWeb	Python.Stealer.737
McAfee-GW-Edition	BehavesLike.Win64.Backdoor.tc
FireEye	Generic.Trojan.Stealer.D.369F589F
Sophos	Mal/Generic-S
Ikarus	Trojan-Spy.Python.TokenGrabber
Avira	TR/Spy.Agent.rdrem
MAX	malware (ai score=81)
Gridinsoft	Malware.Win64.Gen.bot
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	HEUR:Trojan.Python.Agent.gen
GData	Generic.Trojan.Stealer.D.369F589F
Google	Detected
Acronis	suspicious
ALYac	Generic.Trojan.Stealer.D.369F589F
TrendMicro-HouseCall	TROJ_GEN.R002H0CI423
Tencent	Win64.Trojan-PSW.Disco.Wdkl
SentinelOne	Static AI - Suspicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	Python/Stealer.645!tr
AVG	Python:Agent-IR [Trj]
DeepInstinct	MALICIOUS

main.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All