Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 21, 2024, 1:36 p.m.	Oct. 21, 2024, 1:38 p.m.

Size	326.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`3663c34a774b45d65edb817e27dcbdae`
SHA256	`f203e00cfa3c0ff98670d56ace48c0ee7bf1a997309a8da1379d5291cbe37c3d`
CRC32	`CE819911`
ssdeep	`6144:Uypo5x1dkBovN2s0GGDwmW9pLbLGou5YLQRjpj3xm3Z9F+MEuMBoSVGLJnt2QE92:Uypo5eBovNguMGSVGLM7uXjazj6AE+W`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

Name	Response	Post-Analysis Lookup
beautyandstyles.shop		172.67.159.186
instoreperplexion.shop		104.21.96.89

IP Address	Status	Action
164.124.101.2	Active	Moloch

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return
GetComputerNameA Oct. 21, 2024, 1:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 21, 2024, 1:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 21, 2024, 1:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 21, 2024, 1:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 21, 2024, 1:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 21, 2024, 1:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 21, 2024, 1:36 p.m.	computer_name: TEST22-PC	1	1

wmi	SELECT * FROM Win32_Processor

registry

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion

Time & API	Arguments	Status	Return	Repeated
LdrGetDllHandle Oct. 21, 2024, 1:36 p.m.	module_name: snxhk.dll module_address: 0x00000000 stack_pivoted: 0		3221225781	0
LdrGetDllHandle Oct. 21, 2024, 1:36 p.m.	module_name: snxhk.dll module_address: 0x00000000 stack_pivoted: 0		3221225781	0

file	C:\Users\admin\Documents\Outlook Files\outlook.pst
file	C:\Users\admin\Documents\Outlook Files\honey@pot.com.pst

Bkav	W32.Common.ADF87998
Lionic	Trojan.Win32.Tasker.tsFh
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Agent
Skyhigh	BehavesLike.Win32.CoinMiner.fh
ALYac	Gen:Variant.Zusy.561939
Cylance	Unsafe
VIPRE	Gen:Variant.Zusy.561939
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (D)
BitDefender	Gen:Variant.Zusy.561939
K7GW	Trojan ( 005b828b1 )
K7AntiVirus	Trojan ( 005b828b1 )
Arcabit	Trojan.Zusy.D89313
VirIT	Trojan.Win32.Genus.WPB
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Agent.AGPC
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
Kaspersky	HEUR:Trojan.Win32.Tasker.gen
Alibaba	Trojan:Win32/Tasker.8a8dd890
NANO-Antivirus	Trojan.Win32.Jaik.ksnqzu
MicroWorld-eScan	Gen:Variant.Zusy.561939
Rising	Trojan.Amadey!8.11DFB (TFE:5:vGhulzjTAJ)
Emsisoft	Gen:Variant.Zusy.561939 (B)
F-Secure	Trojan.TR/Agent.pnejj
DrWeb	Trojan.Siggen29.50405
Zillya	Trojan.Agent.Win32.4023913
TrendMicro	Trojan.Win32.AMADEY.YXEI3Z
McAfeeD	Real Protect-LS!3663C34A774B
CTX	exe.trojan.generic
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.3663c34a774b45d6
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/Agent.pnejj
Antiy-AVL	Trojan/Win32.Agent
Kingsoft	Win32.HeurC.KVMH017.a
Gridinsoft	Ransom.Win32.Wacatac.sa
Xcitium	Malware@#6bbfm4orcbfh
Microsoft	Trojan:Win32/Multiverze
ViRobot	Trojan.Win.Z.Zusy.334336
ZoneAlarm	HEUR:Trojan.Win32.Tasker.gen
GData	Gen:Variant.Zusy.561939
Varist	W32/ABTrojan.JQES-8323
AhnLab-V3	Trojan/Win.Generic.C5659602
McAfee	Artemis!3663C34A774B
DeepInstinct	MALICIOUS

ZZZ.exe