Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 17, 2024, 10:36 a.m.	Oct. 17, 2024, 10:56 a.m.

Size	127.5KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`bd38b3834594180499a656b6cf3dfab0`
SHA256	`1a085e145268798a5d9cb955eb3ab785b76e5c1aef2ff60fed45d81fcb8e2421`
CRC32	`B03C6921`
ssdeep	`3072:T8hfQUx++uUwqUjWkuVPfrHaa/09adnw62xm4+5j:ARQUELNjTuVPTaQwA5j`
Yara	Win_Amadey_Zero - Amadey bot Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
2064
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip.dll,Main
2148
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
1680
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip.dll,
2240

Name	Response	Post-Analysis Lookup
dukastotranza.click	A 79.110.62.15	79.110.62.15
specificsecurity.ru	A 79.110.62.15	79.110.62.15
smartkontur.site

IP Address	Status	Action
164.124.101.2	Active	Moloch
79.110.62.15	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 79.110.62.15:80 -> 192.168.56.103:49164	2400007	ET DROP Spamhaus DROP Listed Traffic Inbound group 8	Misc Attack
TCP 79.110.62.15:80 -> 192.168.56.103:49164	2402000	ET DROP Dshield Block Listed Source group 1	Misc Attack

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 17, 2024, 10:36 a.m.			0	0
IsDebuggerPresent Oct. 17, 2024, 10:36 a.m.			0	0
IsDebuggerPresent Oct. 17, 2024, 10:36 a.m.			0	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	POST method with no referer header, POST method with no useragent header				suspicious_request	POST http://dukastotranza.click/NfjxzZz8jn/index.php
suspicious_features	POST method with no referer header, POST method with no useragent header				suspicious_request	POST http://specificsecurity.ru/NfjxzZz9jn/index.php

Performs some HTTP requests (2 events)

request	POST http://dukastotranza.click/NfjxzZz8jn/index.php
request	POST http://specificsecurity.ru/NfjxzZz9jn/index.php

Sends data using the HTTP POST Method (2 events)

request	POST http://dukastotranza.click/NfjxzZz8jn/index.php
request	POST http://specificsecurity.ru/NfjxzZz9jn/index.php

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744d7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74450000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74501000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2148 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744d7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2148 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2148 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2148 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2148 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74450000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 2148 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74501000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 1680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744d7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 1680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 1680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 1680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 1680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74450000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:36 a.m.	process_identifier: 1680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74501000 process_handle: 0xffffffff	1

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.ClipBanker.Z!c
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Zusy.446682
Cylance	Unsafe
VIPRE	Gen:Variant.Zusy.446682
Sangfor	Banker.Win32.Clipbanker.V6by
CrowdStrike	win/malicious_confidence_90% (D)
BitDefender	Gen:Variant.Zusy.446682
K7GW	Trojan ( 005b155f1 )
K7AntiVirus	Trojan ( 005b155f1 )
Arcabit	Trojan.Zusy.D6D0DA
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/ClipBanker.SJ
Avast	Win32:TrojanX-gen [Trj]
ClamAV	Win.Malware.Zusy-10015683-0
Kaspersky	HEUR:Trojan.Win32.Agent.gen
Alibaba	Trojan:Win32/Amadey.556d2580
NANO-Antivirus	Trojan.Win32.SpyBot.kpzgmh
MicroWorld-eScan	Gen:Variant.Zusy.446682
Rising	Trojan.ClipBanker!8.5FB (TFE:5:nquGHEI3J2D)
Emsisoft	Gen:Variant.Zusy.446682 (B)
F-Secure	Trojan.TR/ClipBanker.xacmi
DrWeb	Trojan.SpyBot.1512
Zillya	Trojan.ClipBanker.Win32.22962
TrendMicro	TROJ_GEN.R002C0DI524
McAfeeD	ti!1A085E145268
CTX	dll.trojan.clipbanker
Sophos	Mal/Generic-S
FireEye	Gen:Variant.Zusy.446682
Jiangmin	Trojan.Agent.extk
Google	Detected
Avira	TR/ClipBanker.xacmi
Antiy-AVL	Trojan/Win32.ClipBanker
Kingsoft	Win32.Trojan.Agent.gen
Xcitium	Malware@#lgt2qxfigjq2
Microsoft	Trojan:Win32/Amadey.MA!MTB
ZoneAlarm	HEUR:Trojan.Win32.Agent.gen
GData	Gen:Variant.Zusy.446682
Varist	W32/ABPWS.YBKL-4384
AhnLab-V3	Trojan/Win.Amadey.C5582822
McAfee	Artemis!BD38B3834594
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.ClipBanker
Ikarus	Trojan.Win32.Clipbanker
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R002C0DI524
Tencent	Malware.Win32.Gencirc.1418f674
huorong	TrojanSpy/ClipBanker.y

clip.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All