popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

g.exe

Generic Malware Malicious Library ASPack UPX Malicious Packer PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 7, 2024, 10:30 a.m. Oct. 7, 2024, 10:32 a.m.
Size 2.7MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 9c2aeb99843094262e5038fd152a7db1
SHA256 b1a74465a8c446d1b86d5984defdc18c9c06ad6107b7eb147f37df9b78cda104
CRC32 164D9939
ssdeep 49152:P2oh8doKrZmeR5B1qf5LVohWStiOtg01HTulXG:wZmenaVohWSsOtg0wQ
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • ASPack_Zero - ASPack packed file
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Suricata Alerts

No Suricata Alerts

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.101:49161
43.130.10.102:443 		None None None
TLS 1.3
192.168.56.101:49169
103.143.72.251:443 		None None None
TLS 1.3
192.168.56.101:49170
103.143.72.251:443 		None None None

section .rodata
resource name AFX_DIALOG_LAYOUT
name AFX_DIALOG_LAYOUT language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a082c size 0x00000002
name RT_MENU language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a34d0 size 0x0000015e
name RT_MENU language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a34d0 size 0x0000015e
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a466c size 0x0000015c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a466c size 0x0000015c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a466c size 0x0000015c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a466c size 0x0000015c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a466c size 0x0000015c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a466c size 0x0000015c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a466c size 0x0000015c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a466c size 0x0000015c
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a65f0 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a65f0 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a65f0 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a65f0 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a65f0 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a65f0 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a65f0 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a65f0 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a65f0 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a65f0 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a65f0 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a65f0 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a65f0 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002a65f0 size 0x00000068
Time & API Arguments Status Return Repeated

CreateServiceW

 service_start_name:
start_type: 2
password:
display_name: TTXN GotoHTTP Agent
filepath: C:\Users\test22\AppData\Local\Temp\"C:\Users\test22\AppData\Local\Temp\g.exe" service
service_name: GotoHTTP
filepath_r: "C:\Users\test22\AppData\Local\Temp\g.exe" service
desired_access: 983551
service_handle: 0x00243b80
error_control: 1
service_type: 16
service_manager_handle: 0x00243bd0
1 2374528 0
section {u'size_of_data': u'0x0020d200', u'virtual_address': u'0x00001000', u'entropy': 6.857245289672508, u'name': u'.text', u'virtual_size': u'0x0020d131'} entropy 6.85724528967 description A section with a high entropy has been found
entropy 0.761602610587 description Overall entropy of this PE file is high
service_name GotoHTTP service_path C:\Users\test22\AppData\Local\Temp\"C:\Users\test22\AppData\Local\Temp\g.exe" service
Lionic Trojan.Win32.GotoHTTP.4!c
Skyhigh Artemis!Trojan
ALYac Gen:Variant.Zusy.557167
Cylance Unsafe
VIPRE Gen:Variant.Zusy.557167
BitDefender Gen:Variant.Zusy.557167
K7GW Unwanted-Program ( 005b7d8b1 )
K7AntiVirus Unwanted-Program ( 005b7d8b1 )
Arcabit Trojan.Zusy.D8806F
Elastic malicious (moderate confidence)
ESET-NOD32 a variant of Win32/RemoteAdmin.GotoHTTP.A potentially unsafe
MicroWorld-eScan Gen:Variant.Zusy.557167
Rising Hacktool.GotoHTTP!8.1A1BF (CLOUD)
Emsisoft Gen:Variant.Zusy.557167 (B)
F-Secure Trojan.TR/AVI.Agent.lzrrv
DrWeb Trojan.MulDrop28.26985
CTX exe.trojan.gotohttp
Sophos Generic Reputation PUA (PUA)
FireEye Gen:Variant.Zusy.557167
Jiangmin Trojan.Zusy.ic
Avira TR/AVI.Agent.lzrrv
Antiy-AVL RiskWare[RemoteAdmin]/Win32.GotoHTTP
Gridinsoft Ransom.Win32.STOP.tr!n
GData Gen:Variant.Zusy.557167
McAfee Artemis!9C2AEB998430
DeepInstinct MALICIOUS
Malwarebytes Malware.AI.23903407
MaxSecure Trojan.Malware.273330203.susgen
Paloalto generic.ml
alibabacloud Trojan:Win/RemoteAdmin.GalbCJG8