popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

xCvecthUdXEH.exe

Browser Login Data Stealer Generic Malware Malicious Library Downloader UPX Malicious Packer PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Oct. 23, 2023, 1:21 p.m. Oct. 23, 2023, 1:24 p.m.
Size 481.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0b6133d5b36cd98c3391f03ae97633d7
SHA256 d34a31171bb2c40cc7d51b5a9090faee60fc2caee9672c0b287ae3f76e9c3d52
CRC32 B25B3AA4
ssdeep 12288:fRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/Zf2cDU:fx7cyF2eSsewS8W47eZO
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • Malicious_Packer_Zero - Malicious Packer
  • Network_Downloader - File Downloader
  • infoStealer_browser_b_Zero - browser info stealer
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
geoplugin.net
A 178.237.33.50
178.237.33.50
fortuna777.duckdns.org
A 46.246.82.16
46.246.82.16
IP Address Status Action
164.124.101.2 Active Moloch
178.237.33.50 Active Moloch
46.246.82.16 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.102:63709 -> 164.124.101.2:53 2042936 ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain Potentially Bad Traffic
UDP 192.168.56.102:63709 -> 164.124.101.2:53 2022918 ET INFO DYNAMIC_DNS Query to *.duckdns. Domain Misc activity
TCP 192.168.56.102:49161 -> 46.246.82.16:1998 2032776 ET MALWARE Remcos 3.x Unencrypted Checkin Malware Command and Control Activity Detected
TCP 46.246.82.16:1998 -> 192.168.56.102:49161 2032777 ET MALWARE Remcos 3.x Unencrypted Server Response Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .gfids
suspicious_features GET method with no useragent header suspicious_request GET http://geoplugin.net/json.gp
domain fortuna777.duckdns.org
request GET http://geoplugin.net/json.gp
description xCvecthUdXEH.exe tried to sleep 350 seconds, actually delayed analysis time by 350 seconds
Time & API Arguments Status Return Repeated

SetWindowsHookExA

 thread_identifier: 0
callback_function: 0x0040a1cb
hook_identifier: 13 (WH_KEYBOARD_LL)
module_address: 0x00400000
1 131357 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Remcos.4!c
Elastic Windows.Trojan.Remcos
MicroWorld-eScan Generic.Remcos.9EEC0772
CAT-QuickHeal Trojan.GenericPMF.S30359509
Skyhigh BehavesLike.Win32.Remcos.gh
McAfee Remcos-FDQO!0B6133D5B36C
Cylance unsafe
VIPRE Generic.Remcos.9EEC0772
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 0053ac2c1 )
Alibaba Backdoor:Win32/Remcos.a5d4caa1
K7GW Trojan ( 0053ac2c1 )
Cybereason malicious.7e7780
Arcabit Generic.Remcos.9EEC0772
Baidu Win32.Trojan.Kryptik.awm
VirIT Trojan.Win32.GenusT.DMHR
Symantec Trojan Horse
ESET-NOD32 a variant of Win32/Rescoms.B
Cynet Malicious (score: 100)
APEX Malicious
ClamAV Win.Trojan.Remcos-9841897-0
Kaspersky HEUR:Backdoor.Win32.Remcos.gen
BitDefender Generic.Remcos.9EEC0772
NANO-Antivirus Trojan.Win32.Remcos.jwpryz
SUPERAntiSpyware Trojan.Agent/Gen-Crypt
Avast Win32:RATX-gen [Trj]
Tencent Backdoor.Win32.Remcos.hb
Emsisoft Generic.Remcos.9EEC0772 (B)
F-Secure Backdoor.BDS/Backdoor.Gen
DrWeb Trojan.Inject4.57973
Zillya Trojan.Rescoms.Win32.1410
FireEye Generic.mg.0b6133d5b36cd98c
Sophos Mal/Emogen-Y
Ikarus Trojan.Win32.Remcos
Jiangmin Backdoor.Remcos.dvb
Webroot W32.Trojan.Gen
Varist W32/Rescoms.W.gen!Eldorado
Avira BDS/Backdoor.Gen
Antiy-AVL Trojan[Backdoor]/Win32.Rescoms.b
Kingsoft malware.kb.a.1000
Xcitium Malware@#3ret2bjqnvczc
Microsoft Trojan:Win32/Remcos!ic
ZoneAlarm HEUR:Backdoor.Win32.Remcos.gen
GData Generic.Remcos.9EEC0772
Google Detected
AhnLab-V3 Backdoor/Win.Remcos.R590443
BitDefenderTheta Gen:NN.ZexaF.36738.ECW@aq!Cefai
ALYac Generic.Remcos.9EEC0772
MAX malware (ai score=100)