popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

clientPower.exe

Malicious Library Admin Tool (Sysinternals etc ...) UPX Malicious Packer MZP Format PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 12, 2023, 2:50 p.m. Oct. 12, 2023, 2:53 p.m.
Size 5.7MB
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 96a2d507409c68e291e2d473a2d35ae0
SHA256 265122b7fb9dd7b3c4cf0adbcc046d84b33693c2ba49c5bfede1de48f24acbc7
CRC32 4985AAEE
ssdeep 98304:K/9GEgliiRbu0qX0xWAlydfrNxqXiEmNkwq3EZtabizHq:KQlA0xLMNsia3csWHq
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • Malicious_Packer_Zero - Malicious Packer
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • mzp_file_format - MZP(Delphi) file format
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .itext
section .didata
packer BobSoft Mini Delphi -> BoB / BobSoft
resource name CVGB
resource name NPNG
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
__dbk_fcall_wrapper+0x422 TMethodImplementationIntercept-0x5ec5a clientpower+0x12306 @ 0x412306
__dbk_fcall_wrapper+0x78ea TMethodImplementationIntercept-0x57792 clientpower+0x197ce @ 0x4197ce
TMethodImplementationIntercept+0x32b443 dbkFCallWrapperAddr-0x1a299 clientpower+0x39c3a3 @ 0x79c3a3
__dbk_fcall_wrapper-0x7ff0 clientpower+0x9ef4 @ 0x409ef4
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc06d007f
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 1637416
registers.edi: 0
registers.eax: 1637416
registers.ebp: 1637496
registers.edx: 0
registers.ebx: 1971585024
registers.esi: 8130656
registers.ecx: 1
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734e2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ad0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x5ff40000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x5ff40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75763000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x5ff50000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x5ff50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75767000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75767000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75763000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x000001b0
process_name: taskhost.exe
process_identifier: 2404
1 1 0

Process32NextW

 snapshot_handle: 0x000001b0
process_name: clientPower.exe
process_identifier: 2564
1 1 0
section {u'size_of_data': u'0x001ad600', u'virtual_address': u'0x0041e000', u'entropy': 7.928301916208924, u'name': u'.rsrc', u'virtual_size': u'0x001ad508'} entropy 7.92830191621 description A section with a high entropy has been found
entropy 0.292539601431 description Overall entropy of this PE file is high
process clientpower.exe
Skyhigh Artemis!Trojan
McAfee Artemis!96A2D507409C
Alibaba TrojanDownloader:Win32/Rugmi.d16f1288
Symantec Trojan.Gen.MBT
ESET-NOD32 Win32/TrojanDownloader.Rugmi.AAN
Avast Win32:Malware-gen
Sophos Mal/Generic-S
F-Secure Trojan.TR/Rugmi.arpkk
TrendMicro Trojan.Win32.PRIVATELOADER.YXDJKZ
Ikarus Trojan-Downloader.Win32.Rugmi
Google Detected
Avira TR/Rugmi.arpkk
Microsoft Trojan:Win32/Wacatac.B!ml
VBA32 TScope.Trojan.Delf
Cylance unsafe
TrendMicro-HouseCall Trojan.Win32.PRIVATELOADER.YXDJKZ
Rising Downloader.Rugmi!8.11816 (CLOUD)
AVG Win32:Malware-gen
DeepInstinct MALICIOUS