Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 24, 2024, 7:40 a.m.	June 24, 2024, 7:42 a.m.

Size	5.8MB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`6c149b39619395a8ba117a4cae95ba6f`
SHA256	`c43b64c78f6ccba5cfb7de13fc39d5cc43fad9a9f5e78799b34100ab69e5e4e8`
CRC32	`23C7A589`
ssdeep	`49152:IsLm1+6M1hSfHiiQsaaR6GRNxM2u8RpZAPN0E8hKfOFuyjh5EYR/xbsSrpMih44K:F8Gi57VpZqGFLEeZ8+F+5`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE64 - (no description) DllRegisterServer_Zero - execute regsvr32.exe UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
__exception__ June 24, 2024, 7:40 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 5369944064 registers.r15: 0 registers.rcx: -1 registers.rsi: 2618881 registers.r10: 3221225480 registers.rbx: -10000 registers.rsp: 2619224 registers.r11: 514 registers.r8: 2619264 registers.r9: 350 registers.rdx: 0 registers.r12: 2619792 registers.rbp: 2619288 registers.rdi: 5364234976 registers.rax: 0 registers.r13: 4456128	1	0	0

Bkav	W64.AIDetectMalware
Lionic	Trojan.Win32.WinGo.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 99)
Cylance	Unsafe
VIPRE	Trojan.GenericKD.73252824
Sangfor	Dropper.Win32.Wingo.Vxdr
K7AntiVirus	Trojan ( 005af30d1 )
BitDefender	Trojan.GenericKD.73252824
K7GW	Trojan ( 005af30d1 )
Arcabit	Trojan.Generic.D45DBFD8
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of WinGo/TrojanDropper.Agent.CS
Avast	Win64:Malware-gen
Kaspersky	Trojan.MSIL.Agent.qwitvg
Alibaba	TrojanDropper:MSIL/WinGo.e9211239
MicroWorld-eScan	Trojan.GenericKD.73252824
Rising	Trojan.Injector!1.F43F (CLASSIC)
Emsisoft	Trojan.GenericKD.73252824 (B)
F-Secure	Trojan.TR/AVI.Agent.prkqf
TrendMicro	Trojan.Win64.PRIVATELOADER.YXEFVZ
McAfeeD	ti!C43B64C78F6C
FireEye	Trojan.GenericKD.73252824
Sophos	Mal/Generic-S
Ikarus	Win32.Outbreak
Webroot	W32.Trojan.Agent.Gen
Google	Detected
Avira	TR/AVI.Agent.prkqf
MAX	malware (ai score=89)
Antiy-AVL	Trojan/Win32.Casdet
Kingsoft	MSIL.Trojan.Agent.qwitvg
Gridinsoft	Trojan.Win64.Agent.cl
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	Trojan.MSIL.Agent.qwitvg
GData	Win64.Trojan.Agent.CZT72A
Varist	W64/ABRisk.WTGC-4225
AhnLab-V3	Trojan/Win.Evo-gen.C5558850
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.1391608069
TrendMicro-HouseCall	Trojan.Win64.PRIVATELOADER.YXEFVZ
Tencent	Msil.Trojan.Agent.Yylw
SentinelOne	Static AI - Suspicious PE
MaxSecure	Win.MxResIcn.Heur.Gen
Fortinet	W32/Agent.CS!tr
AVG	Win64:Malware-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (W)
alibabacloud	Trojan[dropper]:Multi/Agent.CB

taskweaker.exe