popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

NewLatest.exe

Amadey Generic Malware UPX Malicious Library Malicious Packer PE64 PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us June 17, 2024, 1:25 p.m. June 17, 2024, 1:33 p.m.
Size 415.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 07101cac5b9477ba636cd8ca7b9932cb
SHA256 488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77
CRC32 270C3494
ssdeep 12288:5fSPtGpmLb84Jjzo6yrBuKuJ+ITOC0Ud:UtGpmf8edykhV0Ud
Yara
  • Malicious_Packer_Zero - Malicious Packer
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49166 -> 185.172.128.116:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49164 -> 185.172.128.116:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49167 -> 185.172.128.19:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 185.172.128.19:80 -> 192.168.56.103:49167 2014819 ET INFO Packed Executable Download Misc activity
TCP 185.172.128.116:80 -> 192.168.56.103:49164 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.172.128.19:80 -> 192.168.56.103:49167 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.172.128.116:80 -> 192.168.56.103:49164 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 185.172.128.19:80 -> 192.168.56.103:49167 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 185.172.128.116:80 -> 192.168.56.103:49164 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 185.172.128.19:80 -> 192.168.56.103:49167 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 185.172.128.116:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49171 -> 104.20.3.235:443 906200068 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (CoinMiner) undefined
UDP 192.168.56.103:64894 -> 164.124.101.2:53 2033268 ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org) Potential Corporate Privacy Violation
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2033268 ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org) Potential Corporate Privacy Violation

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.103:49170
163.172.171.111:10943 		None None None
TLS 1.3
192.168.56.103:49171
104.20.3.235:443 		None None None
TLS 1.3
192.168.56.103:49172
51.15.58.224:14433 		None None None

suspicious_features POST method with no referer header, POST method with no useragent header, Connection to IP address suspicious_request POST http://185.172.128.116/Mb3GvQs8/index.php
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://185.172.128.116/b2c2c1.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://185.172.128.19/FirstZ.exe
request POST http://185.172.128.116/Mb3GvQs8/index.php
request GET http://185.172.128.116/b2c2c1.exe
request GET http://185.172.128.19/FirstZ.exe
request POST http://185.172.128.116/Mb3GvQs8/index.php
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00f80000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1236
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004b60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2268
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 237568
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0062a000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2268
region_size: 438272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00490000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\1000003001\b2c2c1.exe
file C:\Users\test22\AppData\Local\Temp\1000004001\FirstZ.exe
file C:\Users\test22\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
file C:\Users\test22\AppData\Local\Temp\1000003001\b2c2c1.exe
file C:\Users\test22\AppData\Local\Temp\1000004001\FirstZ.exe
file C:\Users\test22\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
file C:\Users\test22\AppData\Local\Temp\1000003001\b2c2c1.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000003001\b2c2c1.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000003001\b2c2c1.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000004001\FirstZ.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000004001\FirstZ.exe
1 1 0
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZÿÿ¸@躴 Í!¸LÍ!This program cannot be run in DOS mode. $dgRF < < <Op—9<Op¢8<Op–w<)~¯#< =w<Op“!<Op¦!<Op¡!<Rich <PELhiºdà  >È0P@’Y¬v(€€‰Ôvps(s@P0.textÀ<> `.rdata¨-P.B@@.data€ö€$p@À.rsrc€‰€Š”@@V‹ñÇsDèøöD$tVè]Y‹Æ^á4ïÆÃUl$ˆì˜‹ƒep‰Eh¡ÐD‰…ìýÿÿ¡ÔDV‹s‰…èýÿÿWEpDžàýÿÿ¹y7žè¸ÿÿÿ¡ØDEp?‹=܏D‰…äýÿÿDžðýÿÿ ÇEôƒEô‹Eh‹ÈÁáäýÿÿ‰Mt‹ Eù©u ÇE@.ëíùëuƒ%Œ E‹MpȋEhÁè‰El‹ElÇ3Á3EtÇüEî=êô+ð‰El‹ÆÁà‰Et‹…ìýÿÿEt‹Mp‹ÆÁèΉEl‹…èýÿÿEl1Mt=E uhðqDjjÿ4PD‹El1Et‹Et)EhDž`ÿÿÿŒ²°UDž@ÿÿÿ—s·eDžPÿÿÿˆÃh<Džÿÿÿƒ6Džhÿÿÿ÷ BÇEÐæGÇE0ÆÄõ?DžLÿÿÿÐæŠLDžþÿÿü†2ÇE””uM6ÇEØqvbÇEdˆÒ£DžÔþÿÿüºwÇEԜ(×ÇE4²oRÇELàSkÇE´¦ß6XDžlÿÿÿåFoDžàþÿÿ«{\DžÜþÿÿ!ofÇE (ˀrDžÀþÿÿvtÅDž ÿÿÿÜ{gVDžÿÿÿiÚ¾?Džpÿÿÿl÷³ Dž ÿÿÿ@HDžðþÿÿhw€'ÇEfƒ·OÇE¼IQÝDž|ÿÿÿðdCZÇE8™ šdÇE¬ÿ7§DžXÿÿÿŒï°-ÇEܟ­"Dž(ÿÿÿ¶ò=yDžxÿÿÿ&†¬KDžÈþÿÿ}²ÇE@9Ë#:ÇEG«ÇEH.:àÇE †tDžôýÿÿccDžÌþÿÿŽaU"ÇET9[*DžTÿÿÿç/K ÇE€Å ôDžüþÿÿìwð=ÇEü`3ÇE<ÑâšÇEˆ«DDž þÿÿƒç‰IDž,ÿÿÿõ’íMÇEàý]+ÇEŽ -2ÇE6é¾hÇEè]sHDžÿÿÿ¢ÃÂIDž|þÿÿR‚ÇEP7Ð0DžÄþÿÿµZdrDž4ÿÿÿCoö Dž¼þÿÿ”>6cDžHÿÿÿ²5ÇE„nÙS?ÇEäÜÍ jDž\ÿÿÿ²å› ÇE˜±x[ÇE ¢S\sDžøþÿÿQí‰Džìþÿÿ2<8DžÐþÿÿi|QÇEX¬Gž#ÇE` ^(Džÿÿÿz;VDž¨þÿÿq>÷ÇEðxÜADž¤þÿÿF“PÇEœr÷JiÇEø¨5qDžüýÿÿސ€6Džxþÿÿ¤GoÇE¤ÕHÇE¨xy~ÇEٔºhÇEŒbÎR!Dž¸þÿÿtF@cÇEÄ$¾,hDžØþÿÿIjF_Dž<ÿÿÿ!#“WDž¬þÿÿó%zDždÿÿÿ Eð#ÇE$¿&>Dž„þÿÿ‹óZDžèþÿÿ´ÇE¤e|îDDž0ÿÿÿÀÃÁQÇE°£æ£"ÇE\.8\Džþÿÿ» nQDž´þÿÿdAñ1ÇE¸l‘î Dždþÿÿ6óìDžÿÿÿøié/Dž`þÿÿ¬ƒ[ÇE(u…pEDž$ÿÿÿÈAmÇEÀÎ/pxDžÿÿÿ:A|Dž þÿÿºN9ÇEÌ{{°}ÇEÈJÌØDžˆþÿÿQGKÇED`ú¼@Dž(þÿÿ²Nø#Džþÿÿª“fDžþÿÿäÈ)Dž$þÿÿ…~%Džøýÿÿ¾s6ÇE,Ãàl?DžDþÿÿ?Dž þÿÿ—·lcDžDÿÿÿ§3€+DžXþÿÿ·¼û4Dž4þÿÿRµ‰nDžLþÿÿ±1Dž”þÿÿ©à+DžtÿÿÿíYÇE–˜ÇEì.Džhþÿÿ¥¿GvDžTþÿÿX6ÓDžlþÿÿº• kDžäþÿÿz†P7DžpþÿÿR1œPDžÿÿÿs¢ *Dž8ÿÿÿ¹žÞfDžôþÿÿ:2Œ@DžHþÿÿÆ³>Džþÿÿ517ODžþÿÿ:OÎZDžþÿÿò{ ,Dž˜þÿÿ§ŸÂxDžœþÿÿÀmo Dž<þÿÿõ{‡IDžtþÿÿ«æ-,DžŒþÿÿŠ*R ÇEª‡YDž0þÿÿØWjDžPþÿÿ]GDž\þÿÿ륗.DžþÿÿÐÂDž€þÿÿ££(,Dž°þÿÿ–Ë/~Dž8þÿÿó r#Dž,þÿÿ¾žfDž@þÿÿQG²­`ÿÿÿ®}b¸ ™Î:÷¥`ÿÿÿ‹…`ÿÿÿ…`ÿÿÿ;Õºs…@ÿÿÿ)51…@ÿÿÿ!ÏD­@ÿÿÿÒjO­`ÿÿÿØÐj…`ÿÿÿ»˜}­`ÿÿÿ%¤=-¸i›Íy÷¥`ÿÿÿ‹…`ÿÿÿ…@ÿÿÿ9¥¾ ¸!¨a@÷¥@ÿÿÿ‹…@ÿÿÿ¸‡†žZ÷¥`ÿÿÿ‹…`ÿÿÿ¸'wËE÷¥`ÿÿÿ‹…`ÿÿÿ¸Õ_B*÷¥`ÿÿÿ‹…`ÿÿÿ­`ÿÿÿ£J¸ÑB¤G÷¥hÿÿÿ‹…hÿÿÿm0C1JZ­@ÿÿÿŸA…`ÿÿÿ£']¸"æ~÷¥Lÿÿÿ‹…Lÿÿÿ¸ë^÷¥`ÿÿÿ‹…`ÿÿÿ…ÿÿÿUXú+­hÿÿÿ„\ê|EÐcK*¸Zíë&÷¥Pÿÿÿ‹…Pÿÿÿ¸6=÷¥Pÿÿÿ‹…Pÿÿÿ¸ "·÷e؋E؁…ÿÿÿ½vÂ1­ÿÿÿSr±­`ÿÿÿû)Ï3…PÿÿÿCMâ¸!`og÷e0‹E0mÔß ê+…hÿÿÿßs£_¸P©N÷¥Ôþÿÿ‹…ÔþÿÿEd&/œx¸\;q(÷¥@ÿÿÿ‹…@ÿÿÿ¸þrˆ'÷¥Pÿÿÿ‹…Pÿÿÿ¸¥ô4/÷eL‹EL­Pÿÿÿ>¥˜m¸S'«;÷eԋEÔ¸Ÿ>Ä}÷e4‹E4¸%d%÷¥hÿÿÿ‹…hÿÿÿ…ÀþÿÿªóWl¸0&ef÷eԋEԁ…Pÿÿÿ’Y l…`ÿÿÿžj(¸Ä1u÷¥ÿÿÿ‹…ÿÿÿ…@ÿÿÿvhdc¸àZ!p÷e ‹E …ÔþÿÿÈ®w&…Pÿÿÿº_”¸}'Y÷¥hÿÿÿ‹…hÿÿÿE‰I”E %_ì+E ­¶äs¸©Ÿ)÷¥ ÿÿÿ‹… ÿÿÿ¸íüíl÷e8‹E8m8Ý LmLHŽ­ðþÿÿ=R—D¸ÔÆ©&÷e܋E܁…lÿÿÿ ŒStE ë"c…ÿÿÿè^þ1­xÿÿÿD6+¸S ¡T÷¥@ÿÿÿ‹…@ÿÿÿ…ÔþÿÿoþW­àþÿÿÖ Wu¸¿d}÷¥@ÿÿÿ‹…@ÿÿÿ¸“¹Js÷e¬‹E¬­xÿÿÿ’L„qE·Ï/1E´}3+mEçE´•ªX$¸‘­×#÷eԋEԁ­Üþÿÿ‚Õ3mÔÚfôFm¼gfd…(ÿÿÿdT4m´L0ß<­pÿÿÿýdõWEØóÒ/…ÔþÿÿµGc…ÀþÿÿL¶–J¸“‰ÅL÷e܋E܁mL”öz­àþÿÿŸ¼þ~m 4©&Eܬ½Ñ(¸ëm‚÷e¼‹E¼…`ÿÿÿg–MmHM„¸Í$P?÷¥hÿÿÿ‹…hÿÿÿ…xÿÿÿÏË[­xÿÿÿCõsP¸QÆAF÷¥Àþÿÿ‹…Àþÿÿmˆo'Eܹ?ÏG¸èªP÷¥Pÿÿÿ‹…Pÿÿÿ¸èUñ÷¥ÿÿÿ‹…ÿÿÿE€Ýa\…@ÿÿÿýK}E8®°%…lÿÿÿûá]…pÿÿÿ«;„6…Ìþÿÿ‚6Ç0mØPgK¸Ô›y÷e”‹E”¸ó-½!÷e¬‹E¬m0çƒç<m4?$ím4º¡b¸¦ïY,÷¥(ÿÿÿ‹…(ÿÿÿ…@ÿÿÿë724­`ÿÿÿ] S­ÿÿÿ D™Eèºy‚$¸4IIP÷¥ ÿÿÿ‹… ÿÿÿm¬iÃø_Eîdz4­hÿÿÿ¿…¡¸”Y£÷e@‹E@E42‘ÏX
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEd†œÒ®eð" ’(@@0)`¨Ë<)ˆÐ(Œ )x °(´8@ÍX.textV’ `.rdataü"°$–@@.dataé'àÖ'º@À.pdataŒÐ((@@.00cfgà(’(@@.tlsð(”(@À.rsrcˆ)–(@@.relocx )¬(@BVHƒì H‹ ÇH‹ ÇH‹ ÇH‹ ՟·1ÀúMZuKHcQ<<PEu>HÑ·Qú tú u'ƒytr!HÁè냹„rHÁø1Àƒ9•ÀH‹ ŽŸƒ9‰¡£(¹ƒÙèŽH‹ٟ‹0è ‰0H‹¹Ÿ‹0èê‰0èƒH‹,Ÿƒ8u H è 1ÀHƒÄ ^ÃHƒì(H‹•Ÿ‹‰=£(H6£(H‹ oŸD‹ H‰D$ H $£(H!£(L"£(è}HƒÄ(ÀHƒì(H‹՞Çè HƒÄ(ÃfAWAVVWSHƒì eH‹%0H‹xH‹5ɞ1ÀðH±>”Ãt.H9Çt)L‹5Ù¼f„¹èAÿÖ1ÀðH±>”ÃtH9ÇuçH‹=ž‹ƒøu ¹èÿŒë'ƒ?t Æy¢(ëÇH‹ zžH‹{žèöŒ‹ƒøuH‹ PžH‹Qžè܌Ç„Ût1ÀH‡H‹æH‹H…Àt1ɺE1ÀÿÆÍ(è9H  ÿ¼H‹ åH‰H +è& èHc=Ρ(H ý蝌H‰ÆH…ÿ~G‰ûL‹5´¡(E1ÿf„K‹ þ藌HxH‰ùèkŒJ‰þK‹þH‰ÁI‰øèhŒIÿÇL9ûuÐë1ÛHÇÞH‰5e¡(èØH‹a¡(H‹ "H‹ H‰‹ B¡(H‹?¡(L‹@¡(è )‰A¡(ƒ=¡(t €=-¡(u 讋‹$¡(HƒÄ [_^A^A_ÉÁèŋÌ@Hƒì(H‹ŜÇèúýÿÿHƒÄ(ÃfHƒì(臋1ÉHƒøɉÈHƒÄ(ÄÃÌÌÌXH‰L$H‰T$L‰D$L‰L$ Hƒì(‹ MÌ舆‰NÌH1Éè*‰H‰CÌH1À‹6ÌHƒÄ(H‹L$H‹T$L‹D$L‹L$ I‰Ê ÌÿÌÿ5ÌÃÇòË’ èÿÿÿÇãËQ²?èrÿÿÿÇÔË= C}ècÿÿÿÇÅËÈ\%,èTÿÿÿǶËÅ$VèEÿÿÿǧ˲Śè6ÿÿÿǘË{ºÛ8è'ÿÿÿÇ‰Ë TñèÿÿÿÇzËhypüè ÿÿÿÇkËÁÜRÔèúþÿÿÇ\ËÑú_ÓèëþÿÿÇMË`4*ÞèÜþÿÿÇ>˃€èÍþÿÿÇ/˅’‡è¾þÿÿÇ ËǛ*éè¯þÿÿÇË]laàè þÿÿÇËËKÓàè‘þÿÿÇóÊُâè‚þÿÿÇäÊ>ÄèsþÿÿÇÕÊ£®~èdþÿÿÇÆÊ6™ÿ8èUþÿÿÇ·ÊëË?ìèFþÿÿǨÊn©™è7þÿÿÇ™Ê)?âè(þÿÿÇŠÊ5¥@dèþÿÿÇ{Êq¼²è þÿÿÇlʝµ¨èûýÿÿÇ]ÊìlÃèìýÿÿÇNÊ_ôèÝýÿÿÇ?ʄœÍ=èÎýÿÿÇ0Ê<]]Êè¿ýÿÿÇ!Ênö…†è°ýÿÿÇÊEÀ†”è¡ýÿÿÌÌÌÌÌÌÌÌÌÌÌÌÌHƒì(H‹ ÊH‹H…Àt.ffff.„ÿâÉ(H‹ëÉHHH‰ àÉH‹@H…ÀußHƒÄ(Ãf.„VWSHƒì H‹5:š‹ƒøÿu¸ÿÿÿÿfDHÿÀHƒ<Îuô…Àt%‰ÇHÿÏH‰û„H‹DþÿmÉ(Hÿ˅ÿH‰ßuëH TÿÿÿHƒÄ [_^é¸üÿÿ„VWSHƒì €=’(tHƒÄ [_^ÃƁ(H‹5²™‹ƒøÿu¸ÿÿÿÿfffff.„HÿÀHƒ<Îuô…Àt%‰ÇHÿÏH‰û„H‹DþÿÝÈ(Hÿ˅ÿH‰ßuëH ÄþÿÿHƒÄ [_^é(üÿÿÌÌÌÌÌÌÌÌ1ÀÃÌÌÌÌÌÌÌÌÌÌÌÌÌVWHƒì(H‹c™ƒ8tǃút<ƒúuAH5¿³H=¸³H9÷uë,f„HƒÇH9þtH‹H…ÀtïÿQÈ(ëçºè ¸HƒÄ(_^Ð1ÀÃffff.„Hƒì(ƒút…Òuèî¸HƒÄ(ÃÌÌÌÌVWHƒì8H‰Î‹ÿȃøwH˜H љHc<HÏëH=†™¹è[ L‹NFòN òL$0D$ Hk™H‰ÁI‰øè1‡1ÀHƒÄ8_^ÃÌÌÌÌÌÌÌÌÛãÃÌÌÌÌÌÌÌÌÌÌÌÌÌUAWAVAUATVWSHƒìHl$€=ü›(…mÆï›(Hƒì èn HƒÄ H˜H€HÅHƒàðè“ H)ÄH‰àH‰ƛ(Çě(H‹=ŚH‰øH+ÚHƒøŽH‹²šH‰øH)ØHƒø |,H‹Ÿšƒ;u/H‹“šƒ{u"H‹†šHX ƒxHE؃;u ƒ{„ÓH;\šsHL‹5«–Huffffff.„‹‹KB1Lñ‰EHƒì A¸H‰òèHƒÄ HƒÃH9ûrҋ›(…À~g¿H‹ìš(1ÛHuøL‹5¿´ëffff.„HÿÃHcÈHƒÇ(H9Ë}0D‹D:ðE…ÀtçH‹L:øH‹:Hƒì I‰ñAÿÖHƒÄ H‹™š(‹›š(ëÁHe[_^A\A]A^A_]ËSƒú…[HƒÃ H;y™ƒaÿÿÿL‹5ĕL=½—A¼‹HuøI½ÿÿÿÿëffffff.„HƒÃ H9ûƒ!ÿÿÿ‹KA‰ÈAàøAƒÀøA¬ÈAƒø‡×‹‹CLðN‹ 2Oc‡MúAÿâD¶M“ÿÿÿE„ÛëD·M“ÿÿfE…Ûë D‹O+E…ÛMIÓëL‹LòI)ÒMÊL‰Uø¶Ñƒú?w&IÇÃÿÿÿÿ‰ÑIÓãI÷ÓM9ÚLJÿIÇÃÿÿÿÿIÓãM9Ú|:Aƒø‡DÿÿÿE£Äƒ:ÿÿÿIcÈH0˜L‹ÊHƒì H‰ÁH‰òèMHƒÄ éÿÿÿHƒì0L‰T$ H —I‰Àè̶ÑHƒì H ؖè¹Hƒì H ––è©Ì„AWAVATVWSHƒìXL‰ÇH‰ÓH‰ÎD‹=ë˜(E…ÿ~GH‹ט(J ýH ‰1Òë€HƒÂ(H9Ñt#L‹DI9ðwíL‹L E‹IMÈI
request_handle: 0x00cc000c
1 1 0
host 185.172.128.116
host 185.172.128.19
file C:\ProgramData\AVAST Software
file C:\ProgramData\Avira
file C:\ProgramData\Kaspersky Lab
file C:\ProgramData\Panda Security
file C:\ProgramData\Bitdefender
file C:\ProgramData\AVG
file C:\ProgramData\Doctor Web
file C:\Windows\Tasks\Hkbsse.job
Bkav W32.AIDetectMalware
Elastic Windows.Generic.Threat
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Downloader.gh
ALYac Gen:Variant.Zusy.535702
Cylance Unsafe
VIPRE Gen:Variant.Zusy.535702
Sangfor Trojan.Win32.Save.a
BitDefender Gen:Variant.Zusy.535702
Cybereason malicious.c5b947
Arcabit Trojan.Zusy.D82C96
Baidu Win32.Trojan.Delf.in
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/TrojanDownloader.Amadey.A
APEX Malicious
Avast Win32:BotX-gen [Trj]
MicroWorld-eScan Gen:Variant.Zusy.535702
Rising Trojan.Generic@AI.100 (RDML:YyBMl7uMvG9OOBVs/XK1xg)
Emsisoft Gen:Variant.Zusy.535702 (B)
McAfeeD Real Protect-LS!07101CAC5B94
Trapmine malicious.high.ml.score
FireEye Generic.mg.07101cac5b9477ba
Sophos ML/PE-A
Ikarus Trojan-Downloader.Win32.Amadey
Google Detected
MAX malware (ai score=87)
Kingsoft malware.kb.a.987
GData Gen:Variant.Zusy.535702
Varist W32/Agent.HSX.gen!Eldorado
BitDefenderTheta AI:Packer.6BC20F6D1F
DeepInstinct MALICIOUS
VBA32 BScope.TrojanDownloader.Deyma
Malwarebytes Malware.AI.4164328995
SentinelOne Static AI - Malicious PE
MaxSecure Win.MxResIcn.Heur.Gen
Fortinet W32/Amadey.A!tr.dldr
AVG Win32:BotX-gen [Trj]
CrowdStrike win/malicious_confidence_90% (D)