popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

ZHHR.txt.exe

Browser Login Data Stealer Generic Malware Malicious Library Downloader UPX Malicious Packer PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 July 20, 2024, 8:06 p.m. July 20, 2024, 8:08 p.m.
Size 482.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 fa702e456caa471e2b07df76d37de539
SHA256 e74ffe1434d51967d227826b273e637743112bfc49b93b701e4c6fbdef5858d1
CRC32 6323E8D2
ssdeep 6144:WXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZoAX0cN05Gv:WX7tPMK8ctGe4Dzl4h2QnuPs/Zoxcv
Yara
  • Network_Downloader - File Downloader
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • infoStealer_browser_b_Zero - browser info stealer
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
geoplugin.net
A 178.237.33.50
178.237.33.50
www.vandashproject.site
A 103.161.133.243
103.161.133.243
IP Address Status Action
103.161.133.243 Active Moloch
164.124.101.2 Active Moloch
178.237.33.50 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49161 -> 103.161.133.243:2404 2032776 ET MALWARE Remcos 3.x Unencrypted Checkin Malware Command and Control Activity Detected
TCP 103.161.133.243:2404 -> 192.168.56.102:49161 2032777 ET MALWARE Remcos 3.x Unencrypted Server Response Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .gfids
suspicious_features GET method with no useragent header suspicious_request GET http://geoplugin.net/json.gp
request GET http://geoplugin.net/json.gp
description ZHHR.txt.exe tried to sleep 350 seconds, actually delayed analysis time by 350 seconds
Time & API Arguments Status Return Repeated

SetWindowsHookExA

 thread_identifier: 0
callback_function: 0x0040a2a4
hook_identifier: 13 (WH_KEYBOARD_LL)
module_address: 0x00400000
1 131357 0
Bkav W32.AIDetectMalware
Elastic Windows.Trojan.Remcos
MicroWorld-eScan Generic.Remcos.5FB48E8A
CAT-QuickHeal Backdoor.RemcosIH.S31010159
Skyhigh BehavesLike.Win32.Remcos.gh
ALYac Generic.Remcos.5FB48E8A
Cylance Unsafe
VIPRE Generic.Remcos.5FB48E8A
Sangfor Trojan.Win32.Save.a
K7AntiVirus Riskware ( 00584baa1 )
BitDefender Generic.Remcos.5FB48E8A
K7GW Riskware ( 00584baa1 )
Cybereason malicious.56caa4
Arcabit Generic.Remcos.5FB48E8A
Baidu Win32.Trojan.Kryptik.awm
VirIT Trojan.Win32.Genus.UED
Symantec ML.Attribute.HighConfidence
ESET-NOD32 Win32/Rescoms.V
APEX Malicious
McAfee Remcos-FDQO!FA702E456CAA
Avast Win32:RATX-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky HEUR:Backdoor.Win32.Remcos.gen
NANO-Antivirus Trojan.Win32.Remcos.keikbt
SUPERAntiSpyware Trojan.Agent/Gen-Remcos
Rising Backdoor.Remcos!1.BAC7 (CLASSIC)
Emsisoft Generic.Remcos.5FB48E8A (B)
F-Secure Backdoor.BDS/Backdoor.Gen
DrWeb Trojan.Siggen22.19832
Zillya Trojan.Rescoms.Win32.1521
McAfeeD Real Protect-LS!FA702E456CAA
FireEye Generic.mg.fa702e456caa471e
Sophos Mal/Remcos-B
Ikarus Backdoor.Remcos
Jiangmin Backdoor.Remcos.dyc
Google Detected
Avira BDS/Backdoor.Gen
MAX malware (ai score=80)
Antiy-AVL Trojan[Backdoor]/Win32.Rescoms.b
Kingsoft malware.kb.a.1000
Gridinsoft Ransom.Win32.Wacatac.oa!s1
Microsoft Backdoor:Win32/Remcos.GA!MTB
ZoneAlarm HEUR:Backdoor.Win32.Remcos.gen
GData Win32.Trojan.PSE.1OHYAG0
Varist W32/Trojan.SMWB-4856
AhnLab-V3 Backdoor/Win.Remcos.R625673
BitDefenderTheta Gen:NN.ZexaF.36808.ECW@a4YMtebi
DeepInstinct MALICIOUS
VBA32 Backdoor.Remcos
Malwarebytes Generic.Malware.AI.DDS