Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 23, 2023, 9:26 a.m.	Sept. 23, 2023, 9:30 a.m.

Size	5.6MB
Type	MS-DOS executable, MZ for MS-DOS
MD5	`55a7682ff0b918010481c8daa6b76a32`
SHA256	`033b38832db481d558743cc807a3657423535cc01d2e57fbca9035fa581e863d`
CRC32	`B6E4CE29`
ssdeep	`98304:E+r6g4l2S+UDP1iM36EWXNnYL+2WtW6+wZrDUVVS1/RyMMT24EgbtS8QLrvwPO:Ew/SpNiMKEmNnYBoWzwhYVVg/UME24E5`
Yara	UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE32 - (no description) MPRESS_Zero - MPRESS packed file

clip.exe "C:\Users\test22\AppData\Local\Temp\clip.exe"
2540
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\s1yk.0.bat" "
  2660
  - timeout.exe timeout 3
    2720
  - LEAJ.exe "C:\ProgramData\presepuesto\LEAJ.exe"
    2776
    - schtasks.exe "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "LEAJ" /tr C:\ProgramData\presepuesto\LEAJ.exe /f
      2888

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 23, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (3 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 23, 2023, 9:26 a.m.	buffer: The system cannot find the path specified. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 23, 2023, 9:26 a.m.	buffer: Could Not Find C:\Users\test22\AppData\Local\Temp\s1yk.2 console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 23, 2023, 9:26 a.m.	buffer: SUCCESS: The scheduled task "LEAJ" has successfully been created. console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 23, 2023, 9:26 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.MPRESS1
section	.MPRESS2

The file contains an unknown PE resource name possibly indicative of a packer (4 events)

resource name	AFX_DIALOG_LAYOUT
resource name	AVI
resource name	MUI
resource name	TIS

One or more processes crashed (6 events)

Time & API	Arguments	Status
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: clip+0x363ab9 @ 0x763ab9 clip+0x369cad @ 0x769cad exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1638148 registers.edi: 4468736 registers.eax: 1638148 registers.ebp: 1638228 registers.edx: 2130566132 registers.ebx: 5630803 registers.esi: 1995994155 registers.ecx: 2099576832	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: exception.instruction_r: ed e9 b9 68 01 00 56 f4 00 00 8f 80 d8 17 cf f2 exception.symbol: clip+0x3858b3 exception.instruction: in eax, dx exception.module: clip.exe exception.exception_code: 0xc0000096 exception.offset: 3692723 exception.address: 0x7858b3 registers.esp: 1638268 registers.edi: 20327830 registers.eax: 1750617430 registers.ebp: 4468736 registers.edx: 2130532438 registers.ebx: 0 registers.esi: 4112648 registers.ecx: 20	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: exception.instruction_r: ed e9 4b 69 02 00 c3 e9 46 84 00 00 3e 7a c6 ca exception.symbol: clip+0x39cb68 exception.instruction: in eax, dx exception.module: clip.exe exception.exception_code: 0xc0000096 exception.offset: 3787624 exception.address: 0x79cb68 registers.esp: 1638268 registers.edi: 20327830 registers.eax: 1447909480 registers.ebp: 4468736 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 4112648 registers.ecx: 10	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: leaj+0x363ab9 @ 0x763ab9 leaj+0x369cad @ 0x769cad exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1638148 registers.edi: 4468736 registers.eax: 1638148 registers.ebp: 1638228 registers.edx: 2130566132 registers.ebx: 5630803 registers.esi: 1995994155 registers.ecx: 2470248448	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: exception.instruction_r: ed e9 b9 68 01 00 56 f4 00 00 8f 80 d8 17 cf f2 exception.symbol: leaj+0x3858b3 exception.instruction: in eax, dx exception.module: LEAJ.exe exception.exception_code: 0xc0000096 exception.offset: 3692723 exception.address: 0x7858b3 registers.esp: 1638268 registers.edi: 23473694 registers.eax: 1750617430 registers.ebp: 4468736 registers.edx: 2130532438 registers.ebx: 0 registers.esi: 3719432 registers.ecx: 20	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: exception.instruction_r: ed e9 4b 69 02 00 c3 e9 46 84 00 00 3e 7a c6 ca exception.symbol: leaj+0x39cb68 exception.instruction: in eax, dx exception.module: LEAJ.exe exception.exception_code: 0xc0000096 exception.offset: 3787624 exception.address: 0x79cb68 registers.esp: 1638268 registers.edi: 23473694 registers.eax: 1447909480 registers.ebp: 4468736 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 3719432 registers.ecx: 10	1

Allocates read-write-execute memory (usually to unpack itself) (12 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76faf000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76faf000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

LEAJ.exe tried to sleep 212 seconds, actually delayed analysis time by 212 seconds

Creates executable files on the filesystem (2 events)

file	C:\ProgramData\presepuesto\LEAJ.exe
file	C:\Users\test22\AppData\Local\Temp\s1yk.0.bat

Creates a suspicious process (2 events)

cmdline	schtasks.exe /create /sc MINUTE /mo 1 /RL HIGHEST /tn "LEAJ" /tr C:\ProgramData\presepuesto\LEAJ.exe /f
cmdline	"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "LEAJ" /tr C:\ProgramData\presepuesto\LEAJ.exe /f

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 23, 2023, 9:26 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\s1yk.0.bat parameters: filepath: C:\Users\test22\AppData\Local\Temp\s1yk.0.bat	1	1	0
ShellExecuteExW Sept. 23, 2023, 9:26 a.m.	show_type: 0 filepath_r: schtasks.exe parameters: /create /sc MINUTE /mo 1 /RL HIGHEST /tn "LEAJ" /tr C:\ProgramData\presepuesto\LEAJ.exe /f filepath: schtasks.exe	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00591200', u'virtual_address': u'0x00001000', u'entropy': 7.999970729846644, u'name': u'.MPRESS1', u'virtual_size': u'0x00e14000'}

entropy

7.99997072985

description

A section with a high entropy has been found

entropy

0.997899343545

description

Overall entropy of this PE file is high

Potentially malicious URLs were found in the process memory dump (1 event)

url	https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation

Yara rule detected in process memory (32 events)

description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communications over P2P network	rule	Network_P2P_Win
description	Communication using DGA	rule	Network_DGA
description	Steal credential	rule	local_credential_Steal
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Escalate priviledges	rule	Escalate_priviledges
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Take ScreenShot	rule	ScreenShot
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	File Downloader	rule	Network_Downloader

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	schtasks.exe /create /sc MINUTE /mo 1 /RL HIGHEST /tn "LEAJ" /tr C:\ProgramData\presepuesto\LEAJ.exe /f
cmdline	"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "LEAJ" /tr C:\ProgramData\presepuesto\LEAJ.exe /f

Checks for the presence of known windows from debuggers and forensic tools (50 out of 162 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Sept. 23, 2023, 9:26 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:26 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:26 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 23, 2023, 9:26 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 23, 2023, 9:26 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:26 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:26 a.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 23, 2023, 9:26 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 23, 2023, 9:26 a.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 23, 2023, 9:26 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:26 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:26 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 23, 2023, 9:26 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 23, 2023, 9:26 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:26 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:26 a.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 23, 2023, 9:26 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 23, 2023, 9:26 a.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 23, 2023, 9:27 a.m.	class_name: Regmonclass window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Installs itself for autorun at Windows startup (2 events)

cmdline	schtasks.exe /create /sc MINUTE /mo 1 /RL HIGHEST /tn "LEAJ" /tr C:\ProgramData\presepuesto\LEAJ.exe /f
cmdline	"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "LEAJ" /tr C:\ProgramData\presepuesto\LEAJ.exe /f

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\s1yk.0.bat
file	C:\ProgramData\presepuesto\LEAJ.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2660 resumed a thread in remote process 2776
NtResumeThread Sept. 23, 2023, 9:26 a.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2776	1	0	0

Detects VirtualBox through the presence of a registry key (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 23, 2023, 9:26 a.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: exception.instruction_r: ed e9 4b 69 02 00 c3 e9 46 84 00 00 3e 7a c6 ca exception.symbol: clip+0x39cb68 exception.instruction: in eax, dx exception.module: clip.exe exception.exception_code: 0xc0000096 exception.offset: 3787624 exception.address: 0x79cb68 registers.esp: 1638268 registers.edi: 20327830 registers.eax: 1447909480 registers.ebp: 4468736 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 4112648 registers.ecx: 10	1	0	0

File has been identified by 47 AntiVirus engines on VirusTotal as malicious (47 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
MicroWorld-eScan	Trojan.GenericKD.69402639
FireEye	Generic.mg.55a7682ff0b91801
McAfee	Artemis!55A7682FF0B9
Cylance	unsafe
Sangfor	Trojan.Win32.Save.a
Alibaba	TrojanBanker:Win32/ClipBanker.bd9e7c39
Cybereason	malicious.4cd12d
Arcabit	Trojan.Generic.D423000F
BitDefenderTheta	Gen:NN.ZexaF.36722.@puaaeEMG3li
Cyren	W32/ABRisk.VVTI-9211
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	Win32/ClipBanker.RX
APEX	Malicious
Kaspersky	Trojan-Banker.Win32.ClipBanker.zjq
BitDefender	Trojan.GenericKD.69402639
Avast	Win32:Malware-gen
Rising	Trojan.Kryptik!8.8 (TFE:5:biRMGD3p3sV)
Emsisoft	Trojan.GenericKD.69402639 (B)
DrWeb	Trojan.MulDrop23.59394
VIPRE	Trojan.GenericKD.69402639
TrendMicro	Trojan.Win32.AMADEY.YXDIVZ
McAfee-GW-Edition	BehavesLike.Win32.PWSZbot.tc
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
Ikarus	Trojan.Crypt
Webroot	W32.Malware.Gen
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Win32.Sabsik
Gridinsoft	Ransom.Win32.Sabsik.sa
Xcitium	Malware@#2q6fp0l18nppl
Microsoft	Trojan:Win32/Znyonm
ZoneAlarm	Trojan-Banker.Win32.ClipBanker.zjq
GData	Trojan.GenericKD.69402639
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5470080
ALYac	Trojan.GenericKD.69403754
Malwarebytes	Trojan.Dropper
TrendMicro-HouseCall	Trojan.Win32.AMADEY.YXDIVZ
Tencent	Win32.Trojan-Banker.Clipbanker.Nzfl
SentinelOne	Static AI - Suspicious PE
Fortinet	PossibleThreat.ZDS
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

clip.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All