popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

bQ1X.exe

Malicious Packer Downloader PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 10, 2023, 10:15 a.m. Oct. 10, 2023, 10:18 a.m.
Size 233.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5 e230cdc004aa4fa4b61f66fbfd701ee5
SHA256 431f53278c89aa423d08ddc7ea4ddaa23e1c40cf7910b764201efd6890af7afe
CRC32 653EE27D
ssdeep 3072:2OSI2I7txG68nYrugMZJMfsciIpuKNtrUQlAK3qSjYPS+IAXb3Ixi5eFrgurIlN1:zvG68YrvM80ypnjAedo3qiGUY2ChzIT
Yara
  • Malicious_Packer_Zero - Malicious Packer
  • Network_Downloader - File Downloader
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
mexbar.duckdns.org
A 172.111.139.118
172.111.139.118
IP Address Status Action
164.124.101.2 Active Moloch
172.111.139.118 Active Moloch

domain mexbar.duckdns.org
description bQ1X.exe tried to sleep 355 seconds, actually delayed analysis time by 355 seconds
section {u'size_of_data': u'0x00035600', u'virtual_address': u'0x0004f000', u'entropy': 7.93803045483807, u'name': u'UPX1', u'virtual_size': u'0x00036000'} entropy 7.93803045484 description A section with a high entropy has been found
entropy 0.92025862069 description Overall entropy of this PE file is high
section UPX0 description Section name indicates UPX
section UPX1 description Section name indicates UPX
Time & API Arguments Status Return Repeated

SetWindowsHookExA

 thread_identifier: 0
callback_function: 0x0040a2a4
hook_identifier: 13 (WH_KEYBOARD_LL)
module_address: 0x00400000
1 1245395 0
dead_host 172.111.139.118:3119
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Remcos.4!c
MicroWorld-eScan Generic.Dacic.A9349469.A.D0684945
McAfee Artemis!E230CDC004AA
Malwarebytes Malware.AI.4238095733
Zillya Trojan.Rescoms.Win32.1480
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 0053ba121 )
Alibaba Backdoor:Win32/Remcos.fef1fd73
K7GW Trojan ( 0053ba121 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Generic.Dacic.A9349469.A.D0684945
Baidu Win32.Trojan.Kryptik.awm
VirIT Trojan.Win32.Genus.TCT
Cyren W32/Trojan.GCT.gen!Eldorado
Symantec Trojan.Remcos
Elastic malicious (moderate confidence)
ESET-NOD32 a variant of Win32/Rescoms.B
Cynet Malicious (score: 100)
APEX Malicious
ClamAV Win.Trojan.Remcos-9841897-0
Kaspersky HEUR:Backdoor.Win32.Remcos.gen
BitDefender Generic.Dacic.A9349469.A.D0684945
NANO-Antivirus Trojan.Win32.Remcos.kakzkh
Avast Win32:RATX-gen [Trj]
Tencent Malware.Win32.Gencirc.11b71426
Emsisoft Generic.Dacic.A9349469.A.D0684945 (B)
F-Secure Backdoor.BDS/Backdoor.Gen
DrWeb Trojan.DownLoader46.4974
VIPRE Generic.Dacic.A9349469.A.D0684945
TrendMicro Backdoor.Win32.REMCOS.YXDJIZ
McAfee-GW-Edition BehavesLike.Win32.Remcos.dc
Trapmine malicious.high.ml.score
FireEye Generic.mg.e230cdc004aa4fa4
Sophos Mal/Emogen-Y
Ikarus Win32.Outbreak
Jiangmin Backdoor.Remcos.dwr
Webroot W32.Trojan.Remcos
Avira BDS/Backdoor.Gen
Antiy-AVL Trojan[Backdoor]/Win32.Rescoms.b
Gridinsoft Trojan.Win32.Remcos.bot
Microsoft Trojan:Win32/Remcos!ic
ViRobot Trojan.Win.Z.Remcos.238592.D
ZoneAlarm HEUR:Backdoor.Win32.Remcos.gen
GData Generic.Dacic.A9349469.A.D0684945
Google Detected
AhnLab-V3 Trojan/Win.QA.C5376648
BitDefenderTheta Gen:NN.ZexaF.36738.omGfaCWC6Qfi
ALYac Generic.Dacic.A9349469.A.D0684945
MAX malware (ai score=80)