popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

SRV.txt.vbs

Browser Login Data Stealer Generic Malware Malicious Library Downloader UPX Malicious Packer PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 30, 2024, 10:02 a.m. July 30, 2024, 10:04 a.m.
Size 483.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 558ec1566a5e96df14e34f69c20423f1
SHA256 e80dbae39c7a782fa57704cde12fc7aba17ffaf574ca73fa688b3dd1563a9d1c
CRC32 46302C4F
ssdeep 6144:QXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZoAX0cNs5Gv:QX7tPMK8ctGe4Dzl4h2QnuPs/Zodcv
Yara
  • Network_Downloader - File Downloader
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • infoStealer_browser_b_Zero - browser info stealer
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
geoplugin.net
A 178.237.33.50
178.237.33.50
juiololo.duckdns.org
A 45.66.231.190
IP Address Status Action
164.124.101.2 Active Moloch
178.237.33.50 Active Moloch
45.66.231.190 Active Moloch

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .gfids
suspicious_features GET method with no useragent header suspicious_request GET http://geoplugin.net/json.gp
domain juiololo.duckdns.org
request GET http://geoplugin.net/json.gp
Bkav W32.AIDetectMalware
Elastic Windows.Trojan.Remcos
Cynet Malicious (score: 100)
CAT-QuickHeal Backdoor.RemcosIH.S31010159
Skyhigh BehavesLike.Win32.Remcos.gh
ALYac Generic.Remcos.C3A5B078
Cylance Unsafe
VIPRE Generic.Remcos.C3A5B078
Sangfor Trojan.Win32.Save.a
K7AntiVirus Riskware ( 00584baa1 )
BitDefender Generic.Remcos.C3A5B078
K7GW Riskware ( 00584baa1 )
Cybereason malicious.66a5e9
Arcabit Generic.Remcos.C3A5B078
Baidu Win32.Trojan.Kryptik.awm
VirIT Trojan.Win32.Genus.UED
Symantec ML.Attribute.HighConfidence
ESET-NOD32 Win32/Rescoms.V
APEX Malicious
McAfee Remcos-FDQO!558EC1566A5E
Avast Win32:RATX-gen [Trj]
ClamAV Win.Trojan.Remcos-9841897-0
Kaspersky HEUR:Backdoor.Win32.Remcos.gen
NANO-Antivirus Trojan.Win32.Remcos.keikbt
SUPERAntiSpyware Trojan.Agent/Gen-Remcos
MicroWorld-eScan Generic.Remcos.C3A5B078
Rising Backdoor.Remcos!1.BAC7 (CLASSIC)
Emsisoft Generic.Remcos.C3A5B078 (B)
F-Secure Backdoor.BDS/Backdoor.Gen
DrWeb BackDoor.Remcos.433
Zillya Trojan.Rescoms.Win32.1521
McAfeeD Real Protect-LS!558EC1566A5E
FireEye Generic.mg.558ec1566a5e96df
Sophos Mal/Remcos-B
SentinelOne Static AI - Malicious PE
Jiangmin Backdoor.Remcos.dyc
Google Detected
Avira BDS/Backdoor.Gen
MAX malware (ai score=82)
Antiy-AVL Trojan[Backdoor]/Win32.Rescoms.b
Kingsoft malware.kb.a.1000
Gridinsoft Ransom.Win32.Wacatac.oa!s1
Microsoft Backdoor:Win32/Remcos.GA!MTB
ZoneAlarm HEUR:Backdoor.Win32.Remcos.gen
GData Win32.Trojan.PSE.1OHYAG0
Varist W32/Trojan.SMWB-4856
AhnLab-V3 Backdoor/Win.Remcos.R625673
BitDefenderTheta Gen:NN.ZexaF.36810.ECW@a0355ndi
DeepInstinct MALICIOUS
VBA32 Backdoor.Remcos