Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 8, 2024, 5:01 p.m.	July 8, 2024, 5:03 p.m.

Size	7.0MB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`f308be1162c86c3d72ad06c4c85a67d4`
SHA256	`842e6467d3f6bddb484929a8dba9757920e0b484d8addf40a8fe69f8b205f174`
CRC32	`20FB998F`
ssdeep	`49152:EfMhc7XOayJj55BNcU0KA///skFyE6OjBuXVBw5yyk0+fNH4YxVjM5EmOj1Ggdap:Osc7XL4JNgB01XVKkuFEmBhIGFH`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE64 - (no description) DllRegisterServer_Zero - execute regsvr32.exe anti_vm_detect - Possibly employs anti-virtualization techniques UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

Chrome_Password_Remover.exe "C:\Users\test22\AppData\Local\Temp\Chrome_Password_Remover.exe"
2064

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
__exception__ July 8, 2024, 4:52 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 5359517088 registers.r15: 0 registers.rcx: -1 registers.rsi: 3142145 registers.r10: 3221225480 registers.rbx: -10000 registers.rsp: 3142536 registers.r11: 514 registers.r8: 3142576 registers.r9: 350 registers.rdx: 0 registers.r12: 3143096 registers.rbp: 3142592 registers.rdi: 5352439232 registers.rax: 0 registers.r13: 5438944	1	0	0

section

{u'size_of_data': u'0x00004200', u'virtual_address': u'0x0075e000', u'entropy': 7.748891860816983, u'name': u'.rsrc', u'virtual_size': u'0x000041dc'}

entropy

7.74889186082

description

A section with a high entropy has been found

Bkav	W64.AIDetectMalware
Lionic	Trojan.Win32.Agent.Y!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Caynamer
Skyhigh	Artemis!Trojan
ALYac	Trojan.GenericKD.73340256
Cylance	Unsafe
VIPRE	Trojan.GenericKD.73340256
Sangfor	Dropper.Win32.Agent.V4v3
K7AntiVirus	Trojan ( 005af8171 )
BitDefender	Trojan.GenericKD.73340256
K7GW	Trojan ( 005af8171 )
Cybereason	malicious.162c86
Arcabit	Trojan.Generic.D45F1560
VirIT	Trojan.Win64.Agent.GYX
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of WinGo/TrojanDropper.Agent.CS
McAfee	Artemis!F308BE1162C8
Avast	Win64:Malware-gen
Kaspersky	Trojan.MSIL.Agent.qwitzb
Alibaba	TrojanDropper:MSIL/Genric.6f7d35d9
MicroWorld-eScan	Trojan.GenericKD.73340256
Rising	Trojan.Injector!1.F43F (CLASSIC)
Emsisoft	Trojan.GenericKD.73340256 (B)
F-Secure	Trojan.TR/AVI.Agent.qjmll
TrendMicro	Trojan.Win64.AMADEY.YXEGBZ
McAfeeD	ti!842E6467D3F6
FireEye	Trojan.GenericKD.73340256
Sophos	Mal/Generic-S
Ikarus	Trojan.WinGo.Agent
Webroot	W32.Trojan.Agent.Gen
Google	Detected
Avira	TR/AVI.Agent.qjmll
MAX	malware (ai score=82)
Antiy-AVL	Trojan/Win32.Caynamer
Kingsoft	MSIL.Trojan.Agent.qwitzb
Gridinsoft	Trojan.Win64.Agent.cl
Xcitium	Malware@#bb6u541km4j5
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	Trojan.MSIL.Agent.qwitzb
GData	Trojan.GenericKD.73340256
Varist	W64/ABTrojan.IIVN-4825
AhnLab-V3	Trojan/Win.Evo-gen.C5558850
DeepInstinct	MALICIOUS
VBA32	TrojanPSW.Lumma
Malwarebytes	Trojan.FakeChrome
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	Trojan.Win64.AMADEY.YXEGBZ
Tencent	Malware.Win32.Gencirc.14112686

Chrome_Password_Remover.exe