popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

slavamerlov.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 19, 2024, 2:01 p.m. Aug. 19, 2024, 3:22 p.m.
Size 295.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 cecdc6f5ffde0ad1ddc333cc2a59d56e
SHA256 6d374bed2e755bc4a45f1e6ec6997a465be3f425fc27afe3e17a9b5d8e160d38
CRC32 94BF0957
ssdeep 6144:i7ggit9uWKxuASDXAbPn4r/HogCVKmKpisQEkQ:i0gPuASk4ogkuQEk
PDB Path C:\Users\удача\Desktop\tesf\Release\BigProject.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
bitbucket.org
A 104.192.140.24
A 104.192.140.25
A 104.192.140.26
104.192.140.26
IP Address Status Action
104.192.140.26 Active Moloch
164.124.101.2 Active Moloch

pdb_path C:\Users\удача\Desktop\tesf\Release\BigProject.pdb
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
slavamerlov+0x298f8 @ 0x398f8
slavamerlov+0x337e6 @ 0x437e6
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 03 42 3c 89 45 bc c7 85 38 fe ff ff 01 00 00 00
exception.symbol: slavamerlov+0x7d16
exception.instruction: add eax, dword ptr [edx + 0x3c]
exception.module: slavamerlov.exe
exception.exception_code: 0xc0000005
exception.offset: 32022
exception.address: 0x17d16
registers.esp: 4244672
registers.edi: 0
registers.eax: 0
registers.ebp: 4252440
registers.edx: 0
registers.ebx: 4252448
registers.esi: 1
registers.ecx: 0
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Convagent.4!c
Cynet Malicious (score: 100)
ALYac Gen:Variant.Zusy.555781
Malwarebytes Trojan.Injector
VIPRE Gen:Variant.Zusy.555781
Sangfor Trojan.Win32.Agent.Vy0k
K7AntiVirus Trojan ( 005b7fe21 )
BitDefender Gen:Variant.Zusy.555781
K7GW Trojan ( 005b7fe21 )
Arcabit Trojan.Generic.D4616CB0
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Agent_AGen.DSR
APEX Malicious
Avast Win32:DropperX-gen [Drp]
Kaspersky HEUR:Trojan.Win32.Agent.gen
Alibaba Trojan:Win32/Lumma.ead2fb09
NANO-Antivirus Trojan.Win32.AVI.kpsvns
MicroWorld-eScan Gen:Variant.Zusy.555781
Rising Stealer.Convagent!8.1326D (TFE:5:v7KZnnwmzgD)
Emsisoft Gen:Variant.Zusy.555781 (B)
F-Secure Trojan.TR/AVI.Lumma.pjtux
Zillya Trojan.Agent.Win32.3980610
McAfeeD Real Protect-LS!CECDC6F5FFDE
FireEye Gen:Variant.Zusy.555781
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
Webroot W32.Trojan.GenKD
Google Detected
Avira TR/AVI.Lumma.pjtux
MAX malware (ai score=88)
Antiy-AVL Trojan[PSW]/Win32.Convagent
Kingsoft Win32.Trojan.Agent.gen
Xcitium Malware@#2mg7vr628t35v
Microsoft Trojan:Win32/Wacatac.B!ml
ZoneAlarm HEUR:Trojan.Win32.Agent.gen
GData Gen:Variant.Zusy.555781
BitDefenderTheta Gen:NN.ZexaF.36812.sqW@aOn7boh
DeepInstinct MALICIOUS
VBA32 suspected of Trojan.Downloader.gen
Ikarus Trojan.Win32.Agent
Panda Trj/Chgt.AD
TrendMicro-HouseCall TrojanSpy.Win32.LUMMASTEALER.YXEGMZ
Tencent Malware.Win32.Gencirc.141284b1
MaxSecure Trojan.Malware.771626.susgen
Fortinet W32/PossibleThreat
AVG Win32:DropperX-gen [Drp]
Paloalto generic.ml
CrowdStrike win/malicious_confidence_90% (D)
alibabacloud Trojan:Win/Agent_AGen.DBY