popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

66dfd447dcd00_lyla.exe#lyla3

Generic Malware Admin Tool (Sysinternals etc ...) UPX PE File DLL PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Sept. 11, 2024, 10:36 a.m. Sept. 11, 2024, 10:43 a.m.
Size 6.3MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b36f21ca653ea179246c98cda2373879
SHA256 ce083654b6506740c3a45c15e4fb24dcd05cd39e6509bdeeeedd330750a9511a
CRC32 96E1EB18
ssdeep 49152:LZQCY6KFqjMJ9nFpnRmTH4S3dvxqydZMuhLpR+mXsU4AXe8BRDWOvryIkAw3W:2C6R4BdvsydZrzZsU4AXNrDcIrgW
Yara
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
tventyv20pn.top
A 194.87.248.136
194.87.248.136
IP Address Status Action
164.124.101.2 Active Moloch
194.87.248.136 Active Moloch

suspicious_features POST method with no referer header suspicious_request POST http://tventyv20pn.top/v1/upload.php
request POST http://tventyv20pn.top/v1/upload.php
request POST http://tventyv20pn.top/v1/upload.php
domain tventyv20pn.top description Generic top level domain TLD
file C:\Users\test22\AppData\Local\Temp\TxjazzzychmhGUnNABgJ.dll
file C:\Users\test22\AppData\Local\Temp\service123.exe
section {u'size_of_data': u'0x000e2600', u'virtual_address': u'0x00b36000', u'entropy': 6.841324895194332, u'name': u'.reloc', u'virtual_size': u'0x000e24e0'} entropy 6.84132489519 description A section with a high entropy has been found
Lionic Trojan.Win32.CryptBot.i!c
Elastic malicious (high confidence)
CAT-QuickHeal TrojanPWS.Stealer
ALYac Generic.Dacic.3683.6FE1D084
Cylance Unsafe
VIPRE Generic.Dacic.3683.6FE1D084
Sangfor Infostealer.Win32.Cryptbot.Vi76
K7AntiVirus Password-Stealer ( 0054cf561 )
BitDefender Generic.Dacic.3683.6FE1D084
K7GW Password-Stealer ( 0054cf561 )
Arcabit Generic.Dacic.3683.6FE1D084
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/PSW.Agent.OGR
APEX Malicious
Avast Win32:Evo-gen [Trj]
ClamAV Win.Malware.Barys-10032866-0
Kaspersky Trojan-PSW.Win32.Cryptnot.cwo
Alibaba TrojanPSW:Win32/CryptBot.39a31019
MicroWorld-eScan Generic.Dacic.3683.6FE1D084
Rising Trojan.CryptBot!8.19865 (TFE:5:du8Y4XG1zuF)
Emsisoft Generic.Dacic.3683.6FE1D084 (B)
F-Secure Trojan.TR/PSW.Agent.yngzz
TrendMicro Trojan.Win32.PRIVATELOADER.YXEIJZ
McAfeeD ti!CE083654B650
FireEye Generic.Dacic.3683.6FE1D084
Sophos Mal/Generic-S
Webroot W32.Trojan.Gen
Google Detected
Avira TR/PSW.Agent.yngzz
MAX malware (ai score=87)
Antiy-AVL Trojan/Win32.Cryptbot
Kingsoft Win32.Trojan-PSW.Stealer.gen
Gridinsoft Trojan.Win32.CryptBot.tr
Microsoft Trojan:Win32/CryptBot.CCJD!MTB
ZoneAlarm Trojan-PSW.Win32.Cryptnot.cwo
GData Win32.Trojan.PSE.17KK2SY
Varist W32/Agent.JHG.gen!Eldorado
AhnLab-V3 Infostealer/Win.CryptBot.R661185
McAfee Artemis!B36F21CA653E
DeepInstinct MALICIOUS
Malwarebytes Spyware.Stealer
Ikarus Trojan-PSW.Agent
Panda Trj/Genetic.gen
TrendMicro-HouseCall Trojan.Win32.PRIVATELOADER.YXEIJZ
Tencent Trojan.Win32.Agent.16001366
Fortinet W32/Agent.OGR!tr
AVG Win32:Evo-gen [Trj]
Paloalto generic.ml
CrowdStrike win/malicious_confidence_60% (D)
alibabacloud Trojan[stealer]:Win/CryptBot.CWU!3DGW