popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

clip.dll

Amadey Malicious Library UPX PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 29, 2023, 2:22 p.m. Nov. 29, 2023, 2:32 p.m.
Size 102.0KB
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 4194e9b8b694b1e9b672c36f0d868e32
SHA256 97e342fb4dbfe474ab2674682a816931bb9f56814bf13b20ff11ac1939775125
CRC32 65CBF34A
ssdeep 3072:SbEDxEOC3+EX4W2sosmLWuQRAwQrT7xUCYNS60Z:iM7HQ+sCWuQRYoNS60Z
PDB Path D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • UPX_Zero - UPX packed file
  • Win_Amadey_Zero - Amadey bot
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
soetegem.com
tceducn.com
A 175.126.109.15
A 95.86.30.3
A 202.4.114.123
A 2.180.10.7
A 211.181.24.133
A 179.25.159.36
A 175.120.254.9
A 180.94.156.61
A 201.103.122.206
A 211.171.233.129
201.103.122.206
arrunda.ru
IP Address Status Action
164.124.101.2 Active Moloch
202.4.114.123 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
pdb_path D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb
suspicious_features POST method with no referer header, POST method with no useragent header suspicious_request POST http://tceducn.com/forum/index.php
request POST http://tceducn.com/forum/index.php
request POST http://tceducn.com/forum/index.php
domain arrunda.ru description Russian Federation domain TLD
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x744e2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75931000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76e01000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x752e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74460000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 156
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x744f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2260
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x744e2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2260
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75931000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2260
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76e01000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2260
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x752e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2260
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74460000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2260
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x744f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2168
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x744e2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2168
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75931000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2168
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76e01000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2168
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x752e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2168
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74460000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2168
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x744f1000
process_handle: 0xffffffff
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Amadey.4!c
Elastic malicious (high confidence)
ClamAV Win.Malware.Zusy-10001339-0
FireEye Gen:Variant.Zusy.446682
CAT-QuickHeal Trojan.Agent
Skyhigh BehavesLike.Win32.Generic.ch
McAfee Trojan-FUUW!4194E9B8B694
Malwarebytes Malware.AI.1783867092
Sangfor Trojan.Win32.Amadey.Vj1t
K7AntiVirus Trojan ( 005ad93c1 )
BitDefender Gen:Variant.Zusy.446682
K7GW Trojan ( 005ad93c1 )
CrowdStrike win/malicious_confidence_100% (W)
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Agent.AFGA
Cynet Malicious (score: 99)
Kaspersky HEUR:Trojan.Win32.Agent.gen
Alibaba Trojan:Win32/Amadey.8de19203
NANO-Antivirus Trojan.Win32.Clipper.kcgsdq
ViRobot Trojan.Win.Z.Zusy.104448.E
MicroWorld-eScan Gen:Variant.Zusy.446682
Rising Trojan.Agent!8.B1E (TFE:5:UaFrdoZ2D2N)
Emsisoft Gen:Variant.Zusy.446682 (B)
F-Secure Trojan.TR/Agent.judiw
DrWeb Trojan.Clipper.262
VIPRE Gen:Variant.Zusy.446682
TrendMicro TROJ_GEN.R002C0DK723
Sophos Troj/Amadey-K
GData Win32.Trojan.Amadey.C
Google Detected
Avira TR/Agent.judiw
MAX malware (ai score=86)
Antiy-AVL Trojan/Win32.Amadey
Arcabit Trojan.Zusy.D6D0DA
ZoneAlarm HEUR:Trojan.Win32.Agent.gen
Microsoft Trojan:Win32/Amadey.MA!MTB
Varist W32/ABTrojan.OORC-8286
AhnLab-V3 Trojan/Win.FUUW.C5509968
BitDefenderTheta Gen:NN.ZedlaF.36792.gu4@aOGLpini
ALYac Gen:Variant.Zusy.446682
DeepInstinct MALICIOUS
VBA32 TrojanDownloader.Deyma
Cylance unsafe
Panda Trj/GdSda.A
TrendMicro-HouseCall TROJ_GEN.R002C0DK723
Tencent Malware.Win32.Gencirc.13f4ae26
Yandex Trojan.Agent!zKjJg9tPWxY
Ikarus Trojan.Win32.Agent
MaxSecure Trojan.Malware.300983.susgen