popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

clip64.dll

Amadey Malicious Library UPX PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Jan. 6, 2024, 10:48 a.m. Jan. 6, 2024, 10:52 a.m.
Size 102.0KB
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 85af6c99d918757171d2d280e5ac61ef
SHA256 150fb1285c252e2b79dea84efb28722cc22d370328ceb46fb9553de1479e001e
CRC32 D1FB26E2
ssdeep 3072:MYHZ5o8D+sjrW2sosmrtuQRYKr77BUEYW0Z:McDoBkPsituQR5+W0Z
Yara
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • UPX_Zero - UPX packed file
  • Win_Amadey_Zero - Amadey bot
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
185.215.113.68 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 185.215.113.68:80 -> 192.168.56.103:49165 2400020 ET DROP Spamhaus DROP Listed Traffic Inbound group 21 Misc Attack

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
suspicious_features POST method with no referer header, POST method with no useragent header, Connection to IP address suspicious_request POST http://185.215.113.68/theme/index.php
request POST http://185.215.113.68/theme/index.php
request POST http://185.215.113.68/theme/index.php
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x744f2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75931000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76e01000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x752e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74470000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74501000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2148
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x744f2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2148
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75931000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2148
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76e01000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2148
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x752e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2148
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x743f0000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2148
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x744c1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2052
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x744f2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2052
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75931000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2052
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76e01000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2052
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x752e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2052
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x743f0000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2052
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x744c1000
process_handle: 0xffffffff
1 0 0
host 185.215.113.68
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Amadey.4!c
DrWeb Trojan.Clipper.270
MicroWorld-eScan Gen:Variant.Zusy.446682
CAT-QuickHeal Trojan.Agent
Skyhigh BehavesLike.Win32.NetLoader.ch
McAfee GenericRXAA-AA!85AF6C99D918
Malwarebytes Trojan.Clipper
Sangfor Trojan.Win32.Amadey.V6qt
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Trojan:Win32/Amadey.c77e581d
K7GW Trojan ( 005ad93c1 )
K7AntiVirus Trojan ( 005ad93c1 )
Arcabit Trojan.Zusy.D6D0DA
BitDefenderTheta Gen:NN.ZedlaF.36680.gu4@aCV40wbi
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Agent.AFGA
APEX Malicious
ClamAV Win.Malware.Zusy-10015683-0
Kaspersky HEUR:Trojan.Win32.Agent.gen
BitDefender Gen:Variant.Zusy.446682
NANO-Antivirus Trojan.Win32.Clipper.kexcrj
Avast Win32:BotX-gen [Trj]
Tencent Win32.Trojan.Agent.Ljgl
Emsisoft Gen:Variant.Zusy.446682 (B)
F-Secure Trojan.TR/Agent.wkzal
VIPRE Gen:Variant.Zusy.446682
TrendMicro TROJ_GEN.R002C0DA424
Sophos Mal/Generic-S
MAX malware (ai score=82)
Jiangmin Trojan.Agent.etvq
Webroot W32.AGent.Gen
Google Detected
Avira TR/Agent.wkzal
Varist W32/Agent.IBO.gen!Eldorado
Antiy-AVL Trojan/Win32.Amadey
Kingsoft Win32.Trojan.Agent.gen
Gridinsoft Malware.Win32.Agent.cc
Microsoft Trojan:Win32/Amadey.MA!MTB
ZoneAlarm HEUR:Trojan.Win32.Agent.gen
GData Gen:Variant.Zusy.446682
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.FUUW.R626291
VBA32 TrojanDownloader.Deyma
TACHYON Trojan/W32.Agent.104448.YY
Cylance unsafe
Panda Trj/GdSda.A
TrendMicro-HouseCall TROJ_GEN.R002C0DA424
Rising Trojan.Agent!8.B1E (TFE:5:UaFrdoZ2D2N)