Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 16, 2023, 11 a.m.	Oct. 16, 2023, 11:12 a.m.

Size	102.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`ed15379ed0c9f2e2cc0c105fc8f08896`
SHA256	`1ab121c22361884aa13cc654a4e79a6e70240d3ef60bc1e660aeef7bde168aa3`
CRC32	`E599D72D`
ssdeep	`3072:+rU7xUICZ+FOIm2Kosm72uQR6wQr77xUZYNS60Z:uEFhgYsS2uQRevNS60Z`
PDB Path	D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb
Yara	Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description) Win_Amadey_Zero - Amadey bot OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
1880
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
2052
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,Main
2148
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,
2240

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
77.91.97.162	Active	Moloch
74.207.245.195	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 16, 2023, 11 a.m.			0	0
IsDebuggerPresent Oct. 16, 2023, 11 a.m.			0	0
IsDebuggerPresent Oct. 16, 2023, 11 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header, Connection to IP address

suspicious_request

POST http://77.91.97.162/g93kdwj3S/index.php

Performs some HTTP requests (1 event)

request

POST http://77.91.97.162/g93kdwj3S/index.php

Sends data using the HTTP POST Method (1 event)

request

POST http://77.91.97.162/g93kdwj3S/index.php

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 16, 2023, 11 a.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2023, 11 a.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2023, 11 a.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2023, 11 a.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2023, 11 a.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2023, 11 a.m.	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2023, 11 a.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2023, 11 a.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2023, 11 a.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2023, 11 a.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2023, 11 a.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2023, 11 a.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2023, 11 a.m.	process_identifier: 2148 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2023, 11 a.m.	process_identifier: 2148 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2023, 11 a.m.	process_identifier: 2148 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2023, 11 a.m.	process_identifier: 2148 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2023, 11 a.m.	process_identifier: 2148 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2023, 11 a.m.	process_identifier: 2148 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744b1000 process_handle: 0xffffffff	1

Communicates with host for which no DNS query was performed (2 events)

host	77.91.97.162
host	74.207.245.195

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.446682
CAT-QuickHeal	Trojan.Multi
Skyhigh	BehavesLike.Win32.NetLoader.ch
McAfee	Trojan-FUUW!ED15379ED0C9
Malwarebytes	Trojan.Agent
Sangfor	Trojan.Win32.Amadey.V5jc
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Trojan:Win32/Amadey.5d8dddbc
K7GW	Trojan ( 005ac85a1 )
K7AntiVirus	Trojan ( 005ac85a1 )
Arcabit	Trojan.Zusy.D6D0DA
Symantec	Trojan Horse
ESET-NOD32	a variant of Win32/Agent.AFGA
Cynet	Malicious (score: 99)
ClamAV	Win.Malware.Zusy-10001339-0
Kaspersky	HEUR:Trojan.Win32.Agent.gen
BitDefender	Gen:Variant.Zusy.446682
Avast	Win32:Malware-gen
Tencent	Win32.Trojan.Agent.Vmhl
Emsisoft	Gen:Variant.Zusy.446682 (B)
F-Secure	Trojan.TR/Agent.rbcne
DrWeb	Trojan.Clipper.262
VIPRE	Gen:Variant.Zusy.446682
TrendMicro	TROJ_GEN.R06CC0DJC23
FireEye	Gen:Variant.Zusy.446682
Sophos	Troj/Amadey-K
Webroot	W32.Malware.Gen
Varist	W32/ABTrojan.LRHM-6856
Avira	TR/Agent.rbcne
MAX	malware (ai score=82)
Antiy-AVL	Trojan/Win32.Amadey
Gridinsoft	Malware.Win32.Agent.cc
Xcitium	Malware@#3sqcijku2e2r7
Microsoft	Trojan:Win32/Amadey.MA!MTB
ZoneAlarm	HEUR:Trojan.Win32.Agent.gen
GData	Win32.Trojan.Amadey.C
Google	Detected
AhnLab-V3	Trojan/Win.FUUW.C5509968
ALYac	Gen:Variant.Zusy.446682
Cylance	unsafe
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R06CC0DJC23
Rising	Trojan.Generic@AI.100 (RDML:cQ/4n+q+us8nQFQqYiOIiA)
Ikarus	Trojan.Win32.Agent
MaxSecure	Trojan.Malware.300983.susgen
BitDefenderTheta	Gen:NN.ZedlaF.36738.gu4@aOYoLPoi
AVG	Win32:Malware-gen

clip64.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All