Summary | ZeroBOX

oclo.exe

Generic Malware Malicious Library UPX PE64 PE File OS Processor Check
Category Machine Started Completed
FILE s1_win7_x6403_us Sept. 9, 2024, 10:08 a.m. Sept. 9, 2024, 10:14 a.m.
Size 2.3MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 0d14677324fb1f05953aff5dfc889965
SHA256 33e42e7828cda7987d17342e0eb8134f590cd3d291dbc75f13334259a4908ba1
CRC32 0537AF3A
ssdeep 24576:A/VAFdBq01lUapCVXAyOtlru19eSVqhCv4pjX/I+4YTXa779BLwc3oe7X8tCHrfx:Qoz6XDl9jl7f+TgmA0sIM7bov
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

__exception__

stacktrace:
oclo+0x1f6f90 @ 0x13f336f90
oclo+0x23125a @ 0x13f37125a
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521

exception.instruction_r: f3 aa 48 8b 84 24 40 6e 00 00 48 8b 8c 24 08 44
exception.symbol: oclo+0x1f6f90
exception.instruction: stosb byte ptr [rdi], al
exception.module: oclo.exe
exception.exception_code: 0xc0000005
exception.offset: 2060176
exception.address: 0x13f336f90
registers.r14: 0
registers.r15: 0
registers.rcx: 332030
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 1900192
registers.r11: 518
registers.r8: 1727544
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0
1 0 0
Bkav W64.AIDetectMalware
Elastic malicious (high confidence)
ALYac Gen:Variant.Lazy.598188
Cylance Unsafe
VIPRE Gen:Variant.Lazy.598188
BitDefender Gen:Variant.Lazy.598188
Arcabit Trojan.Lazy.D920AC
APEX Malicious
MicroWorld-eScan Gen:Variant.Lazy.598188
Emsisoft Gen:Variant.Lazy.598188 (B)
FireEye Generic.mg.0d14677324fb1f05
MAX malware (ai score=85)
GData Gen:Variant.Lazy.598188
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_60% (D)