Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 2, 2023, 10:04 a.m.	Nov. 2, 2023, 10:06 a.m.

Size	102.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`8da053f9830880089891b615436ae761`
SHA256	`d5482b48563a2f1774b473862fbd2a1e5033b4c262eee107ef64588e47e1c374`
CRC32	`CCD3D704`
ssdeep	`3072:/HEjxEfCk+EeY22JosmvWuQRRIQrT7xUcdYNS60Z:PsqqdLsOWuQRbZeNS60Z`
PDB Path	D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb
Yara	Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description) Win_Amadey_Zero - Amadey bot OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
2136
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,Main
2224
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
1460
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,
2316

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
167.235.20.126	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 2, 2023, 10:04 a.m.			0	0
IsDebuggerPresent Nov. 2, 2023, 10:04 a.m.			0	0
IsDebuggerPresent Nov. 2, 2023, 10:04 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header, Connection to IP address

suspicious_request

POST http://167.235.20.126/bjdm32DP/index.php

Performs some HTTP requests (1 event)

request

POST http://167.235.20.126/bjdm32DP/index.php

Sends data using the HTTP POST Method (1 event)

request

POST http://167.235.20.126/bjdm32DP/index.php

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 2, 2023, 10:04 a.m.	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 2, 2023, 10:04 a.m.	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 2, 2023, 10:04 a.m.	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 2, 2023, 10:04 a.m.	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 2, 2023, 10:04 a.m.	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 2, 2023, 10:04 a.m.	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 2, 2023, 10:04 a.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 2, 2023, 10:04 a.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 2, 2023, 10:04 a.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 2, 2023, 10:04 a.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 2, 2023, 10:04 a.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 2, 2023, 10:04 a.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 2, 2023, 10:04 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 2, 2023, 10:04 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 2, 2023, 10:04 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 2, 2023, 10:04 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 2, 2023, 10:04 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 2, 2023, 10:04 a.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1

Communicates with host for which no DNS query was performed (1 event)

host

167.235.20.126

File has been identified by 38 AntiVirus engines on VirusTotal as malicious (38 events)

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Gen:Variant.Zusy.446682
FireEye	Gen:Variant.Zusy.446682
Skyhigh	BehavesLike.Win32.NetLoader.ch
ALYac	Gen:Variant.Zusy.446682
Malwarebytes	Trojan.Clipper
Zillya	Trojan.Agent.Win32.3743639
K7AntiVirus	Trojan ( 005ac85a1 )
BitDefender	Gen:Variant.Zusy.446682
K7GW	Trojan ( 005ac85a1 )
CrowdStrike	win/malicious_confidence_90% (W)
BitDefenderTheta	Gen:NN.ZedlaF.36792.gu4@aqz@j6ii
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Agent.AFGA
Kaspersky	HEUR:Trojan.Win32.Agent.gen
NANO-Antivirus	Trojan.Win32.Clipper.kcgsdq
Rising	Trojan.Agent!8.B1E (TFE:5:UaFrdoZ2D2N)
Emsisoft	Gen:Variant.Zusy.446682 (B)
DrWeb	Trojan.ClipSpy.92
VIPRE	Gen:Variant.Zusy.446682
Sophos	Troj/Amadey-K
Ikarus	Trojan.Win32.Agent
GData	Win32.Trojan.Amadey.C
Google	Detected
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Win32.Amadey
Arcabit	Trojan.Zusy.D6D0DA
ZoneAlarm	HEUR:Trojan.Win32.Agent.gen
Microsoft	Trojan:Win32/Amadey.MA!MTB
AhnLab-V3	Trojan/Win.FUUW.C5509968
VBA32	TrojanDownloader.Deyma
TACHYON	Trojan/W32.Agent.104448.YW
Panda	Trj/GdSda.A
Tencent	Malware.Win32.Gencirc.11b7a763
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:BotX-gen [Trj]
Avast	Win32:BotX-gen [Trj]

clip64.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All