Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 18, 2024, 9:56 a.m.	Oct. 18, 2024, 10 a.m.

Size	428.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`4dba58c6e9f435c1cca607525760d0fd`
SHA256	`d2886d86ef67a3550a4aadcf623aa785fddcd3af754b3035229647f186005b1c`
CRC32	`C6D43EF3`
ssdeep	`12288:lP83dF+mKpRp++vNPokdXG78m8AfJJdI:4KpzPW8mllI`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

ywx.exe "C:\Users\test22\AppData\Local\Temp\ywx.exe"
1960
- Gxtuum.exe "C:\Users\test22\AppData\Local\Temp\87d87ee084\Gxtuum.exe"
  2196
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
176.111.174.140	Active	Moloch

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Oct. 18, 2024, 9:56 a.m.	process_identifier: 1960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 18, 2024, 9:49 a.m.	process_identifier: 1236 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000006500000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0

file	C:\Users\test22\AppData\Local\Temp\87d87ee084\Gxtuum.exe

file	C:\Users\test22\AppData\Local\Temp\87d87ee084\Gxtuum.exe

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Oct. 18, 2024, 9:56 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\87d87ee084\Gxtuum.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\87d87ee084\Gxtuum.exe	1	1	0

host

176.111.174.140

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

file	C:\Windows\Tasks\Gxtuum.job

dead_host

176.111.174.140:80

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Amadey.a!c
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Generic.gh
ALYac	Gen:Variant.Zusy.552096
Cylance	Unsafe
VIPRE	Gen:Variant.Zusy.552096
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (D)
BitDefender	Gen:Variant.Zusy.552096
Arcabit	Trojan.Zusy.D86CA0
Baidu	Win32.Trojan.Delf.in
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/TrojanDownloader.Amadey.A
APEX	Malicious
Avast	MalwareX-gen [Trj]
ClamAV	Win.Malware.Generic-10033391-0
Kaspersky	HEUR:Trojan-Downloader.Win32.Deyma.gen
MicroWorld-eScan	Gen:Variant.Zusy.552096
Rising	Spyware.Bobik!8.108FF (CLOUD)
Emsisoft	Gen:Variant.Zusy.552096 (B)
F-Secure	Trojan.TR/Redcap.cqflk
McAfeeD	Real Protect-LS!4DBA58C6E9F4
Trapmine	malicious.high.ml.score
CTX	exe.trojan.amadey
Sophos	Troj/Amadey-O
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.4dba58c6e9f435c1
Google	Detected
Avira	TR/Redcap.cqflk
Kingsoft	Win32.Trojan-Downloader.Deyma.gen
Gridinsoft	Ransom.Win32.Wacatac.sa
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	HEUR:Trojan-Downloader.Win32.Deyma.gen
GData	Gen:Variant.Zusy.552096
Varist	W32/Agent.DJJ.gen!Eldorado
McAfee	Artemis!4DBA58C6E9F4
DeepInstinct	MALICIOUS
VBA32	BScope.TrojanDownloader.Deyma
Malwarebytes	Generic.Malware/Suspicious
Ikarus	Trojan.Spy.Stealer
Panda	Trj/Chgt.AD
Tencent	Win32.Trojan-Downloader.Deyma.Simw
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Amadey.A!tr.dldr
AVG	MalwareX-gen [Trj]
Paloalto	generic.ml
alibabacloud	Trojan[downloader]:Win/Amadey.A

ywx.exe