popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

rbxfpsunlocker.exe

Emotet Gen1 Generic Malware Malicious Library ASPack UPX dll PE64 PE File OS Processor Check ZIP Format DLL DllRegisterServer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Oct. 30, 2023, 5:42 p.m. Oct. 30, 2023, 5:45 p.m.
Size 17.6MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 559e4b863c9736d6dd81b67a1c7c51e9
SHA256 6314f6518cd5779e9ba758702432180de55f69e2963601d77a57799569332ffb
CRC32 F23C3D9E
ssdeep 393216:jqPnLFXlrPUgQpDOETgsvfGA/g/uGvESfD8La:mPLFXNPtQoEfauf8C
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • ASPack_Zero - ASPack packed file
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section _RDATA
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
CtfImeIsIME+0x8530 TF_IsCtfmonRunning-0xe28 msctf+0x4a278 @ 0x7fefe25a278
TF_IsCtfmonRunning+0x2f4 TF_RunInputCPL-0x1a19c msctf+0x4b394 @ 0x7fefe25b394
SetInputScope+0x4662 DllRegisterServer-0x10f5e msctf+0x2e1e2 @ 0x7fefe23e1e2
TF_GetInputScope+0x19f3 CtfImeDestroyThreadMgr-0x20a9 msctf+0x14bcb @ 0x7fefe224bcb
TF_GetInputScope+0x2ae9 CtfImeDestroyThreadMgr-0xfb3 msctf+0x15cc1 @ 0x7fefe225cc1
TF_CanUninitialize+0x74 CtfNotifyIME-0x1318 msctf+0x21ea4 @ 0x7fefe231ea4
TF_CleanUpPrivateMessages+0xf48 DllGetClassObject-0x514 msctf+0x180d4 @ 0x7fefe2280d4
TF_CleanUpPrivateMessages+0xf26 DllGetClassObject-0x536 msctf+0x180b2 @ 0x7fefe2280b2
TF_CleanUpPrivateMessages+0xc7b DllGetClassObject-0x7e1 msctf+0x17e07 @ 0x7fefe227e07
TF_CleanUpPrivateMessages+0xbb8 DllGetClassObject-0x8a4 msctf+0x17d44 @ 0x7fefe227d44
RtlProcessFlsData+0x84 LdrUnlockLoaderLock-0x7c ntdll+0x2b894 @ 0x772bb894
LdrShutdownProcess+0xa9 NtdllDialogWndProc_W-0x43b ntdll+0x24249 @ 0x772b4249
RtlExitUserProcess+0x90 LdrShutdownProcess-0x20 ntdll+0x24180 @ 0x772b4180
rbxfpsunlocker+0x18c11 @ 0x13f6b8c11
rbxfpsunlocker+0x18bdc @ 0x13f6b8bdc
rbxfpsunlocker+0xaf94 @ 0x13f6aaf94
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521

exception.instruction_r: ff 50 18 89 9e f8 08 00 00 48 3b fb 74 28 48 39
exception.symbol: CtfImeIsIME+0x8530 TF_IsCtfmonRunning-0xe28 msctf+0x4a278
exception.instruction: call qword ptr [rax + 0x18]
exception.module: MSCTF.dll
exception.exception_code: 0xc0000005
exception.offset: 303736
exception.address: 0x7fefe25a278
registers.r14: 0
registers.r15: 0
registers.rcx: 45464976
registers.rsi: 0
registers.r10: 1
registers.rbx: 0
registers.rsp: 2881792
registers.r11: 0
registers.r8: 2880384
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 8791641515336
registers.r13: 0
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef69c9000
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\_MEI30122\VCRUNTIME140_1.dll
file C:\Users\test22\AppData\Local\Temp\_MEI30122\python3.dll
file C:\Users\test22\AppData\Local\Temp\_MEI30122\pywintypes310.dll
file C:\Users\test22\AppData\Local\Temp\_MEI30122\python310.dll
file C:\Users\test22\AppData\Local\Temp\_MEI30122\libcrypto-1_1.dll
file C:\Users\test22\AppData\Local\Temp\_MEI30122\libssl-1_1.dll
file C:\Users\test22\AppData\Local\Temp\_MEI30122\mfc140u.dll
file C:\Users\test22\AppData\Local\Temp\_MEI30122\VCRUNTIME140.dll
file C:\Users\test22\AppData\Local\Temp\_MEI30122\libffi-7.dll
file C:\Users\test22\AppData\Local\Temp\_MEI30122\pythoncom310.dll
file C:\Users\test22\AppData\Local\Temp\_MEI30122\sqlite3.dll
section {u'size_of_data': u'0x0000f600', u'virtual_address': u'0x00052000', u'entropy': 7.555572206814071, u'name': u'.rsrc', u'virtual_size': u'0x0000f498'} entropy 7.55557220681 description A section with a high entropy has been found
file C:\Users\test22\AppData\Local\Temp\_MEI30122\pyinstaller-5.1.dist-info\INSTALLER
file C:\Users\test22\AppData\Local\Temp\_MEI30122\_ctypes.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\Crypto\Cipher\_raw_aesni.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\Crypto\Cipher\_pkcs1_decode.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\attrs-23.1.0.dist-info\METADATA
file C:\Users\test22\AppData\Local\Temp\_MEI30122\Crypto\Cipher\_raw_cbc.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\Crypto\Hash\_SHA224.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\select.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\Crypto\Hash\_BLAKE2b.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\charset_normalizer\md__mypyc.cp310-win_amd64.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\_decimal.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\python3.dll
file C:\Users\test22\AppData\Local\Temp\_MEI30122\Crypto\Hash\_ghash_portable.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\PIL\_imaging.cp310-win_amd64.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\attrs-23.1.0.dist-info\REQUESTED
file C:\Users\test22\AppData\Local\Temp\_MEI30122\Crypto\Util\_cpuid_c.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\yarl\_quoting_c.cp310-win_amd64.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\pyinstaller-5.1.dist-info\top_level.txt
file C:\Users\test22\AppData\Local\Temp\_MEI30122\Crypto\PublicKey\_ec_ws.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\pyinstaller-5.1.dist-info\entry_points.txt
file C:\Users\test22\AppData\Local\Temp\_MEI30122\Crypto\Hash\_SHA512.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\aiohttp\_http_parser.cp310-win_amd64.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\PIL\_imagingtk.cp310-win_amd64.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\altgraph-0.17.3.dist-info\METADATA
file C:\Users\test22\AppData\Local\Temp\_MEI30122\PIL\_imagingcms.cp310-win_amd64.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\Crypto\PublicKey\_ed25519.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\python310.dll
file C:\Users\test22\AppData\Local\Temp\_MEI30122\_ssl.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\pythoncom310.dll
file C:\Users\test22\AppData\Local\Temp\_MEI30122\VCRUNTIME140_1.dll
file C:\Users\test22\AppData\Local\Temp\_MEI30122\Crypto\Protocol\_scrypt.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\pyinstaller-5.1.dist-info\WHEEL
file C:\Users\test22\AppData\Local\Temp\_MEI30122\Crypto\Cipher\_raw_aes.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\aiohttp\_helpers.cp310-win_amd64.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\Crypto\Cipher\_chacha20.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\pyinstaller-5.1.dist-info\REQUESTED
file C:\Users\test22\AppData\Local\Temp\_MEI30122\pyinstaller-5.1.dist-info\RECORD
file C:\Users\test22\AppData\Local\Temp\_MEI30122\_sqlite3.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\_asyncio.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\Crypto\Cipher\_ARC4.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\Crypto\Cipher\_raw_ocb.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\Crypto\Hash\_ghash_clmul.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\Crypto\Cipher\_raw_ecb.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\Crypto\Hash\_SHA256.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\sqlite3.dll
file C:\Users\test22\AppData\Local\Temp\_MEI30122\_win32sysloader.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\Crypto\Cipher\_raw_blowfish.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\Crypto\Cipher\_raw_des.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI30122\attrs-23.1.0.dist-info\RECORD
file C:\Users\test22\AppData\Local\Temp\_MEI30122\libssl-1_1.dll
Bkav W32.Common.4D409846
Lionic Trojan.Win64.Alien.tslR
MicroWorld-eScan Generic.Trojan.Stealer.D.A5421300
Skyhigh Artemis
McAfee Artemis!559E4B863C97
Malwarebytes Agent.Spyware.Stealer.DDS
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
Alibaba TrojanPSW:Win64/Stealer.e4e3607b
Symantec Infostealer
Elastic malicious (high confidence)
Kaspersky Trojan-PSW.Python.Stealer.aa
BitDefender Generic.Trojan.Stealer.D.A5421300
Tencent Win32.Trojan-QQPass.QQRob.Pgil
Sophos Mal/Generic-S
F-Secure Heuristic.HEUR/AGEN.1358353
DrWeb Python.Stealer.1138
VIPRE Generic.Trojan.Stealer.D.A5421300
TrendMicro TROJ_GEN.R002C0XIG23
FireEye Generic.Trojan.Stealer.D.A5421300
Emsisoft Generic.Trojan.Stealer.D.A5421300 (B)
Ikarus Trojan.Python.Spy
Google Detected
Avira HEUR/AGEN.1358353
Varist W64/S-a56473fb!Eldorado
Gridinsoft Trojan.Win64.Agent.sa
Arcabit Generic.Trojan.Stealer.D.AD52B8F4
ZoneAlarm Trojan-PSW.Python.Stealer.aa
Microsoft Trojan:Win32/Malgent!MSR
Cynet Malicious (score: 99)
Acronis suspicious
ALYac Generic.Trojan.Stealer.D.A5421300
MAX malware (ai score=87)
DeepInstinct MALICIOUS
Cylance unsafe
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R002C0XIG23
Rising Stealer.Empyrean/PYC!1.EACF (CLASSIC)
SentinelOne Static AI - Suspicious PE
MaxSecure Trojan.Malware.121218.susgen
Fortinet Python/Agent.NZ!tr
AVG Python:Agent-IR [Trj]
Avast Python:Agent-IR [Trj]