popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

bthsefyjsec.exe

Generic Malware .NET framework(MSIL) Malicious Library UPX Malicious Packer PE File PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 17, 2024, 1:35 p.m. Oct. 17, 2024, 1:37 p.m.
Size 288.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 a4ba0c64ad8df1955b7661eb2a519b08
SHA256 e9f2774ea342459535d1efb376378dcdcb203e7e57743c939ea3f575f1ec0ad8
CRC32 04F52806
ssdeep 6144:f7zO0LSclT6FOwEP5Kq+SMv0VGb7bDcllbkTn:HlJtTF9zVGkllbkT
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • Is_DotNET_EXE - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
ip-api.com
A 208.95.112.1
208.95.112.1
IP Address Status Action
164.124.101.2 Active Moloch
208.95.112.1 Active Moloch
45.120.178.138 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2054141 ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49165 -> 208.95.112.1:80 2036383 ET MALWARE Common RAT Connectivity Check Observed A Network Trojan was detected
TCP 192.168.56.103:49165 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "NET frameworks" has successfully been created.
console_handle: 0x00000007
1 1 0
request GET http://ip-api.com/json/
domain ip-api.com
host 45.120.178.138
Bkav W32.AIDetectMalware.CS
CAT-QuickHeal Backdoor.MsilFC.S6050939
Skyhigh BehavesLike.Win32.Generic.dh
Cylance Unsafe
VIPRE Gen:Heur.Ransom.Imps.3
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (D)
BitDefender Gen:Heur.Ransom.Imps.3
K7GW Trojan ( 00521dab1 )
K7AntiVirus Trojan ( 00521dab1 )
Arcabit Trojan.Ransom.Imps.3
VirIT Backdoor.Win32.Quasar.AM
Symantec ML.Attribute.HighConfidence
Elastic Windows.Trojan.Quasarrat
ESET-NOD32 a variant of MSIL/Spy.Agent.AES
APEX Malicious
Avast MSIL:Rat-B [Trj]
Kaspersky HEUR:Backdoor.MSIL.Quasar.gen
NANO-Antivirus Trojan.Win32.PWS.edqjme
MicroWorld-eScan Gen:Heur.Ransom.Imps.3
Rising Backdoor.xRAT!1.E17E (CLASSIC)
Emsisoft Gen:Heur.Ransom.Imps.3 (B)
F-Secure Heuristic.HEUR/AGEN.1307329
DrWeb BackDoor.Quasar.1
Zillya Trojan.Agent.Win32.4005592
TrendMicro TSPY_TINCLEX.SM1
McAfeeD Real Protect-LS!A4BA0C64AD8D
Trapmine suspicious.low.ml.score
CTX exe.ransomware.imps
Sophos ATK/Zaquar-D
Ikarus Backdoor.QuasarRat
FireEye Generic.mg.a4ba0c64ad8df195
Jiangmin Backdoor.MSIL.acwb
Webroot W32.Trojan.Gen
Google Detected
Avira HEUR/AGEN.1307329
Antiy-AVL Trojan[Spy]/Win32.Agent.foqx
Kingsoft malware.kb.c.1000
Microsoft Backdoor:MSIL/Quasar.GG!MTB
ZoneAlarm HEUR:Backdoor.MSIL.Quasar.gen
GData MSIL.Backdoor.Quasar.D
Varist W32/MSIL_Mintluks.A.gen!Eldorado
AhnLab-V3 Trojan/Win.Subti.R414075
McAfee GenericRXDY-OW!A4BA0C64AD8D
TACHYON Trojan/W32.DN-Agent.295424.M
DeepInstinct MALICIOUS
VBA32 Trojan.MSIL.Quasar.Heur
Malwarebytes Generic.Malware.AI.DDS
Zoner Trojan.Win32.73504
TrendMicro-HouseCall TSPY_TINCLEX.SM1