popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

svhosts.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 22, 2024, 9:07 a.m. July 22, 2024, 9:10 a.m.
Size 485.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 d39a20fd19892439847037745f81a036
SHA256 1992aa12ce8a82991eed74ef987403a956c1a2b53d333a13a1dfa49eb6695323
CRC32 180728CA
ssdeep 12288:AXS+1BlXqUlPxMtExpePQmwsnCAph0lhSMXlCuSKLZP:AX9qUpqn9h0lhSMXlhS2P
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
api.telegram.org
A 149.154.167.220
149.154.167.220
IP Address Status Action
149.154.167.220 Active Moloch
164.124.101.2 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name:
0 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

SetFileAttributesW

 file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: C:\ProgramData\MyHiddenFolder
filepath: C:\ProgramData\MyHiddenFolder
1 1 0

SetFileAttributesW

 file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: C:\ProgramData\MyHiddenFolder\svhosts.exe
filepath: C:\ProgramData\MyHiddenFolder\svhosts.exe
1 1 0
Time & API Arguments Status Return Repeated

MoveFileWithProgressW

 newfilepath_r: C:\ProgramData\MyHiddenFolder\svhosts.exe
flags: 2
oldfilepath_r: C:\Users\test22\AppData\Local\Temp\svhosts.exe
newfilepath: C:\ProgramData\MyHiddenFolder\svhosts.exe
oldfilepath: C:\Users\test22\AppData\Local\Temp\svhosts.exe
1 1 0
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\My Program reg_value C:\ProgramData\MyHiddenFolder\svhosts.exe
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Generic.4!c
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Trojan.gh
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
BitDefender Trojan.GenericKD.73604139
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:MalwareX-gen [Trj]
Kaspersky UDS:DangerousObject.Multi.Generic
MicroWorld-eScan Trojan.GenericKD.73604139
Emsisoft Trojan.GenericKD.73605913 (B)
DrWeb Trojan.Siggen29.5488
TrendMicro Trojan.Win32.AMADEY.YXEGTZ
McAfeeD Real Protect-LS!D39A20FD1989
FireEye Generic.mg.d39a20fd19892439
Sophos Mal/Generic-S
Google Detected
MAX malware (ai score=89)
Antiy-AVL GrayWare/Win32.Wacapew
Kingsoft Win32.Troj.Unknown.a
Gridinsoft Trojan.Win32.Wacapew.cl
Microsoft Trojan:Win32/Wacatac.B!ml
ZoneAlarm UDS:DangerousObject.Multi.Generic
GData Trojan.GenericKD.73605913
Varist W32/ABTrojan.BRUU-1492
BitDefenderTheta Gen:NN.ZexaF.36810.EuW@aCYFdYai
DeepInstinct MALICIOUS
Malwarebytes Generic.Malware/Suspicious
TrendMicro-HouseCall Trojan.Win32.AMADEY.YXEGTZ
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/PossibleThreat
AVG Win32:MalwareX-gen [Trj]
Paloalto generic.ml
CrowdStrike win/malicious_confidence_100% (W)