Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Dec. 6, 2023, 12:11 p.m.	Dec. 6, 2023, 12:18 p.m.

Size	102.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`92adfbe29d3ddd3afe816ca7e6f183bb`
SHA256	`27c1d590c82b7756fadbbba4f4d8e7ac4ef090fa88c8a37b01e82dddac569f50`
CRC32	`95BCE83E`
ssdeep	`3072:gWlRooD+MzxG2Mosm5quQR5yyrz7BUKBYW0Z:gc2l0RsIquQR5vdCW0Z`
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) PE_Header_Zero - PE File Signature IsDLL - (no description) UPX_Zero - UPX packed file Win_Amadey_Zero - Amadey bot OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
2544
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
2628
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,Main
2720
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,
2808

Name	Response	Post-Analysis Lookup
brodoyouevenlift.co.za	A 89.191.234.91	89.191.234.91
yeahweliftbro.cz

IP Address	Status	Action
164.124.101.2	Active	Moloch
185.196.8.195	Active	Moloch
89.191.234.91	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Dec. 6, 2023, 12:11 p.m.			0	0
IsDebuggerPresent Dec. 6, 2023, 12:11 p.m.			0	0
IsDebuggerPresent Dec. 6, 2023, 12:11 p.m.			0	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address				suspicious_request	POST http://185.196.8.195/u6vhSc3PPq/index.php
suspicious_features	POST method with no referer header, POST method with no useragent header				suspicious_request	POST http://brodoyouevenlift.co.za/jjuhhsa73/index.php

Performs some HTTP requests (2 events)

request	POST http://185.196.8.195/u6vhSc3PPq/index.php
request	POST http://brodoyouevenlift.co.za/jjuhhsa73/index.php

Sends data using the HTTP POST Method (2 events)

request	POST http://185.196.8.195/u6vhSc3PPq/index.php
request	POST http://brodoyouevenlift.co.za/jjuhhsa73/index.php

Allocates read-write-execute memory (usually to unpack itself) (30 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c02000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73571000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734a4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73572000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c02000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73571000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734a4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73572000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c02000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73571000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73451000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73414000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73572000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 6, 2023, 12:11 p.m.	process_identifier: 2720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bd1000 process_handle: 0xffffffff	1

Communicates with host for which no DNS query was performed (1 event)

host

185.196.8.195

File has been identified by 49 AntiVirus engines on VirusTotal as malicious (49 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Amadey.4!c
MicroWorld-eScan	Gen:Variant.Zusy.446682
FireEye	Gen:Variant.Zusy.446682
McAfee	GenericRXAA-AA!92ADFBE29D3D
Malwarebytes	Trojan.Agent
K7AntiVirus	Trojan ( 005ad93c1 )
Alibaba	Trojan:Win32/Amadey.cada63c5
K7GW	Trojan ( 005ad93c1 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZedlaF.36608.gu4@aO8UoBhi
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Agent.AFGA
APEX	Malicious
ClamAV	Win.Malware.Zusy-10015683-0
Kaspersky	HEUR:Trojan.Win32.Agent.gen
BitDefender	Gen:Variant.Zusy.446682
Avast	Win32:BotX-gen [Trj]
Tencent	Win32.Trojan.Agent.Jtgl
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Agent.ivpna
VIPRE	Gen:Variant.Zusy.446682
TrendMicro	TROJ_GEN.R002C0DL423
Emsisoft	Gen:Variant.Zusy.446682 (B)
MAX	malware (ai score=82)
Jiangmin	Trojan.Agent.etvq
Avira	TR/Agent.ivpna
Varist	W32/ABRisk.IARF-9031
Antiy-AVL	Trojan/Win32.Amadey
Kingsoft	Win32.Trojan.Agent.gen
Microsoft	Trojan:Win32/Amadey.MA!MTB
Gridinsoft	Malware.Win32.Agent.cc
Arcabit	Trojan.Zusy.D6D0DA
ViRobot	Trojan.Win.Z.Agent.104448.EA
ZoneAlarm	HEUR:Trojan.Win32.Agent.gen
GData	Gen:Variant.Zusy.446682
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.FUUW.R626291
ALYac	Gen:Variant.Zusy.446682
Cylance	unsafe
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R002C0DL423
Rising	Trojan.Agent!8.B1E (TFE:5:UaFrdoZ2D2N)
Ikarus	Trojan.Win32.Agent
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Agent.AFGA!tr
AVG	Win32:BotX-gen [Trj]
DeepInstinct	MALICIOUS

clip64.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All