popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

event.php

Generic Malware Malicious Library UPX Malicious Packer PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 30, 2024, 9:34 a.m. July 30, 2024, 9:36 a.m.
Size 322.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 61c5a8e414a47b8cc2c69e1ac4370a35
SHA256 4da3bff89fc796886ca615a29a2595c4109f86fff2a9e699ea1036195719cb3b
CRC32 9D14F1EF
ssdeep 6144:l5B8DY9c80tk5koaMrtonT8nzkwHgDKFaz4cHgo2TW:rB8DY9yYhaODRgDKiHgo2a
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "SystemServicesTools" has successfully been created.
console_handle: 0x0000000000000007
1 1 0
Time & API Arguments Status Return Repeated

SetFileAttributesW

 file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: C:\Users\test22\AppData\Roaming\{03BD451ED4621855818353}\{03BD451ED4621855818353}.exe
filepath: C:\Users\test22\AppData\Roaming\{03BD451ED4621855818353}\{03BD451ED4621855818353}.exe
0 0
cmdline schtasks /create /tn "SystemServicesTools" /tr "C:\Users\test22\AppData\Roaming\{03BD451ED4621855818353}\{03BD451ED4621855818353}.exe" /sc onstart /f
cmdline schtasks /create /tn "SystemServicesTools" /tr "C:\Users\test22\AppData\Roaming\{03BD451ED4621855818353}\{03BD451ED4621855818353}.exe" /sc onstart /f
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Services reg_value C:\Users\test22\AppData\Roaming\{03BD451ED4621855818353}\{03BD451ED4621855818353}.exe
cmdline schtasks /create /tn "SystemServicesTools" /tr "C:\Users\test22\AppData\Roaming\{03BD451ED4621855818353}\{03BD451ED4621855818353}.exe" /sc onstart /f
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.Nekark.4!c
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win64.NetLoader.fm
ALYac Trojan.Generic.36634384
Cylance Unsafe
VIPRE Trojan.Generic.36634384
Sangfor Trojan.Win64.Agent.Vgxn
K7AntiVirus Trojan ( 005b776e1 )
BitDefender Trojan.Generic.36634384
K7GW Trojan ( 005b776e1 )
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win64/Agent.EAQ
APEX Malicious
McAfee Artemis!61C5A8E414A4
Avast Win64:TrojanX-gen [Trj]
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Trojan:Win64/Nekark.65487e81
MicroWorld-eScan Trojan.Generic.36634384
Rising Trojan.Agent!8.B1E (TFE:5:Y2bFPPajU2P)
Emsisoft Trojan.Generic.36634384 (B)
F-Secure Trojan.TR/AD.Nekark.nhtjo
DrWeb Trojan.Siggen29.8832
TrendMicro Backdoor.Win64.ASYNCRAT.YXEG2Z
McAfeeD ti!4DA3BFF89FC7
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.61c5a8e414a47b8c
Sophos Mal/Generic-R
SentinelOne Static AI - Malicious PE
Webroot W32.Trojan.Gen
Google Detected
Avira TR/AD.Nekark.nhtjo
MAX malware (ai score=85)
Antiy-AVL GrayWare/Win32.Wacapew
Kingsoft Win32.Trojan.Generic.a
Microsoft Trojan:Win32/Casdet!rfn
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Trojan.Generic.36634384
DeepInstinct MALICIOUS
Malwarebytes Malware.AI.116915355
Ikarus Trojan.Win64.Agent
Panda Trj/Chgt.AD
TrendMicro-HouseCall Backdoor.Win64.ASYNCRAT.YXEG2Z
Tencent Malware.Win32.Gencirc.11c4776b
Fortinet W64/Agent.EAQ!tr
AVG Win64:TrojanX-gen [Trj]
Paloalto generic.ml
CrowdStrike win/malicious_confidence_100% (W)
alibabacloud Trojan:Win/Generic.Gen