popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

script.exe

NSIS Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 24, 2024, 6:57 p.m. Aug. 24, 2024, 7:11 p.m.
Size 1.6MB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 dc37d19933e5689c25bc6cce8c15d58c
SHA256 fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373
CRC32 28FCBAE4
ssdeep 24576:zadIJEV+Vz4OjRZMpM2wSZB8Q04KfA3NapQpN65NlwBy8rTx3ZmIkmu3ylHAhf8:WIii8uqMIBv09cNgHwBy8rVkUkyR+U
Yara
  • Malicious_Library_Zero - Malicious_Library
  • NSIS_Installer - Null Soft Installer
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
104.248.229.104 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49168 -> 104.248.229.104:443 906200068 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (CoinMiner) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.101:49168
104.248.229.104:443 		None None None

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleA

 buffer: ...Checking for previous installation of "Mesh Agent"
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: [NONE]
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: ...Installing service
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: [DONE]
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: -> Writing firewall rules for Mesh Agent Service...
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: [DONE]
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: -> Starting service...
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: [OK]
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
file C:\Program Files (x86)\Mesh Agent\MeshAgent.exe
file C:\Users\test22\AppData\Roaming\Leonardo\leonardo-mesh.exe
Time & API Arguments Status Return Repeated

CreateServiceW

 service_start_name:
start_type: 2
password:
display_name: Mesh Agent
filepath: C:\Users\test22\AppData\Roaming\Leonardo\"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"
service_name: Mesh Agent
filepath_r: "C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"
desired_access: 983551
service_handle: 0x0440bc28
error_control: 0
service_type: 272
service_manager_handle: 0x0440bc50
1 71351336 0
wmi <INVALID POINTER>
host 104.248.229.104
service_name Mesh Agent service_path C:\Users\test22\AppData\Roaming\Leonardo\"C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"
reg_key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Mesh Agent\ImagePath reg_value "C:\Program Files (x86)\Mesh Agent\MeshAgent.exe"
Cylance Unsafe
VirIT Trojan.Win32.Genus.WDM
APEX Malicious
Rising HackTool.MeshAgent!8.13A31 (TFE:5:3FAGppPZPZV)
DrWeb Program.MeshAgent.1
FireEye Generic.mg.dc37d19933e5689c
Antiy-AVL RiskWare[RemoteAdmin]/Win32.MeshAgent
Kingsoft malware.kb.a.886
DeepInstinct MALICIOUS
VBA32 Trojan.Staser
Fortinet Riskware/Application