Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 17, 2024, 10:36 a.m.	Oct. 17, 2024, 11 a.m.

Size	127.5KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`143a210c0ca4bd09985f12b588663ab4`
SHA256	`f827d48567e71dfd1c461fb55eba0487c8d4b37eedbb10141a4b7a4bb4cbb0e4`
CRC32	`D069B633`
ssdeep	`3072:mDrG/eLj+t+YpqUjWouVPkrH3/U9anw62xm4+5j:oaeL6g2jfuVPqWA5j`
Yara	Win_Amadey_Zero - Amadey bot Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
2056
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
800
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip.dll,Main
2144
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip.dll,
2240

Name	Response	Post-Analysis Lookup
amoamoxxx.org	A 45.82.153.229	45.82.153.229

IP Address	Status	Action
164.124.101.2	Active	Moloch
45.82.153.229	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 17, 2024, 10:36 a.m.			0	0
IsDebuggerPresent Oct. 17, 2024, 10:36 a.m.			0	0
IsDebuggerPresent Oct. 17, 2024, 10:36 a.m.			0	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header

suspicious_request

POST http://amoamoxxx.org/h9fmdW5/index.php

Performs some HTTP requests (1 event)

request

POST http://amoamoxxx.org/h9fmdW5/index.php

Sends data using the HTTP POST Method (1 event)

request

POST http://amoamoxxx.org/h9fmdW5/index.php

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744c7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74440000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744c7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743c0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74491000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744c7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74440000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.ClipBanker.Z!c
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.NetLoader.ch
ALYac	Gen:Variant.Zusy.446682
Cylance	Unsafe
VIPRE	Gen:Variant.Zusy.446682
Sangfor	Banker.Win32.Clipbanker.V7ha
CrowdStrike	win/malicious_confidence_70% (D)
BitDefender	Gen:Variant.Zusy.446682
K7GW	Trojan ( 005b155f1 )
K7AntiVirus	Trojan ( 005b155f1 )
Arcabit	Trojan.Zusy.D6D0DA
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/ClipBanker.SJ
Avast	Win32:TrojanX-gen [Trj]
ClamAV	Win.Malware.Zusy-10015683-0
Kaspersky	HEUR:Trojan.Win32.Agent.gen
Alibaba	Trojan:Win32/Amadey.0625736f
NANO-Antivirus	Trojan.Win32.SpyBot.kpzgmh
MicroWorld-eScan	Gen:Variant.Zusy.446682
Rising	Trojan.ClipBanker!8.5FB (TFE:5:nquGHEI3J2D)
Emsisoft	Gen:Variant.Zusy.446682 (B)
F-Secure	Trojan.TR/ClipBanker.enmvp
DrWeb	Trojan.SpyBot.1461
Zillya	Trojan.ClipBanker.Win32.21616
TrendMicro	TROJ_GEN.R06CC0DHV24
McAfeeD	ti!F827D48567E7
CTX	dll.trojan.clipbanker
Sophos	Mal/Generic-S
FireEye	Gen:Variant.Zusy.446682
Jiangmin	Trojan.Agent.extk
Google	Detected
Avira	TR/ClipBanker.enmvp
Antiy-AVL	Trojan/Win32.ClipBanker
Microsoft	Trojan:Win32/Amadey.MA!MTB
ViRobot	Trojan.Win.Z.Clipbanker.130560.C
ZoneAlarm	HEUR:Trojan.Win32.Agent.gen
GData	Gen:Variant.Zusy.446682
AhnLab-V3	Trojan/Win.Amadey.C5582822
McAfee	Artemis!143A210C0CA4
DeepInstinct	MALICIOUS
VBA32	Trojan.Agent
Malwarebytes	Trojan.ClipBanker
Ikarus	Trojan.Win32.Clipbanker
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R06CC0DHV24
Tencent	Malware.Win32.Gencirc.11c6d353
huorong	TrojanSpy/ClipBanker.y

clip.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All