popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

moon.txt.exe

Browser Login Data Stealer Generic Malware Malicious Library Downloader UPX Malicious Packer PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 4, 2024, 10:05 a.m. July 4, 2024, 10:08 a.m.
Size 483.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 076a4a72c5285c9d30401f1c3f7d0c45
SHA256 0c286126eae5d8d419bac3830831dbcfd0deb2b375d21666de4eac3c9824f4a8
CRC32 66714A8A
ssdeep 6144:6XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNl5Gv:6X7tPMK8ctGe4Dzl4h2QnuPs/ZDccv
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • infoStealer_browser_b_Zero - browser info stealer
  • Network_Downloader - File Downloader
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
geoplugin.net
A 178.237.33.50
178.237.33.50
IP Address Status Action
164.124.101.2 Active Moloch
178.237.33.50 Active Moloch
191.101.130.177 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49168 -> 191.101.130.177:6903 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 191.101.130.177:6903 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 191.101.130.177:6903 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49162 -> 191.101.130.177:6903 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.101:49168
191.101.130.177:6903 		None None None
TLS 1.3
192.168.56.101:49166
191.101.130.177:6903 		None None None
TLS 1.3
192.168.56.101:49167
191.101.130.177:6903 		None None None
TLS 1.3
192.168.56.101:49162
191.101.130.177:6903 		None None None

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .gfids
suspicious_features GET method with no useragent header suspicious_request GET http://geoplugin.net/json.gp
request GET http://geoplugin.net/json.gp
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2556
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72d52000
process_handle: 0xffffffff
1 0 0
description moon.txt.exe tried to sleep 448 seconds, actually delayed analysis time by 448 seconds
host 191.101.130.177
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 8 (SystemProcessorPerformanceInformation)
1 0 0
Time & API Arguments Status Return Repeated

SetWindowsHookExA

 thread_identifier: 0
callback_function: 0x0040a2a4
hook_identifier: 13 (WH_KEYBOARD_LL)
module_address: 0x00400000
1 5702025 0
Bkav W32.Common.19ECC1D2
Lionic Trojan.Win32.Remcos.m!c
Elastic Windows.Trojan.Remcos
Cynet Malicious (score: 100)
CAT-QuickHeal Backdoor.RemcosIH.S31010159
Skyhigh BehavesLike.Win32.Remcos.gh
ALYac Generic.Remcos.97550BDE
Cylance Unsafe
VIPRE Generic.Remcos.97550BDE
Sangfor Trojan.Win32.Save.a
K7AntiVirus Riskware ( 00584baa1 )
BitDefender Generic.Remcos.97550BDE
K7GW Riskware ( 00584baa1 )
Cybereason malicious.2c5285
Arcabit Generic.Remcos.D17D0EBDE
Baidu Win32.Trojan.Kryptik.awm
VirIT Trojan.Win32.Genus.UED
Symantec ML.Attribute.HighConfidence
ESET-NOD32 Win32/Rescoms.V
APEX Malicious
McAfee Remcos-FDQO!076A4A72C528
Avast Win32:RATX-gen [Trj]
ClamAV Win.Trojan.Remcos-9841897-0
Kaspersky HEUR:Backdoor.Win32.Remcos.gen
NANO-Antivirus Trojan.Win32.Remcos.keikbt
SUPERAntiSpyware Trojan.Agent/Gen-Remcos
MicroWorld-eScan Generic.Remcos.97550BDE
Rising Backdoor.Remcos!1.BAC7 (CLASSIC)
Emsisoft Generic.Remcos.97550BDE (B)
F-Secure Backdoor.BDS/Backdoor.Gen
DrWeb Trojan.Siggen22.19832
Zillya Trojan.Rescoms.Win32.1521
McAfeeD Real Protect-LS!076A4A72C528
FireEye Generic.mg.076a4a72c5285c9d
Sophos Mal/Remcos-B
Ikarus Backdoor.Remcos
Jiangmin Backdoor.Remcos.dyc
Google Detected
Avira BDS/Backdoor.Gen
MAX malware (ai score=85)
Antiy-AVL Trojan[Backdoor]/Win32.Rescoms.b
Gridinsoft Ransom.Win32.Wacatac.oa!s1
Microsoft Backdoor:Win32/Remcos.GA!MTB
ZoneAlarm HEUR:Backdoor.Win32.Remcos.gen
GData Win32.Trojan.PSE.1OHYAG0
Varist W32/Trojan.SMWB-4856
AhnLab-V3 Backdoor/Win.Remcos.R625673
BitDefenderTheta Gen:NN.ZexaF.36806.ECW@aub0MQfi
DeepInstinct MALICIOUS
VBA32 Backdoor.Remcos