Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

systems.exe

Generic Malware Malicious Library UPX PE64 PE File OS Processor Check

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 6, 2024, 9:08 a.m.	Aug. 6, 2024, 9:12 a.m.

Size	971.8KB
Type	PE32+ executable (console) x86-64, for MS Windows
MD5	`168fd1d2a0af4fdaa019f351fd03204d`
SHA256	`e7d461204302d4ed4f47079a70070da9f6fe10b074c37cf8463f91f4709cdfb8`
CRC32	`A4B430B6`
ssdeep	`24576:sgdzT3/M7ucGYEi/G5z7QnTpGMTmy7QYKj9KmfbykE2PwD:s4/M7ucGYEi/GsTwfUQvj9KUby0`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE64 - (no description) UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

systems.exe "C:\Users\test22\AppData\Local\Temp\systems.exe"
416

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	.00cfg
section	.gxfg
section	_RDATA

File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 events)

ClamAV	Win.Trojan.Generic-10034176-0
Google	Detected

Harvests credentials from local FTP client softwares (1 event)

registry

HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions