popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

get.php

Generic Malware UPX PE32 PE File .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 24, 2024, 11 a.m. Oct. 24, 2024, 11:04 a.m.
Size 93.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 4548851d7e7973d57dbc4cf37b11e40e
SHA256 d30c1065c41dd783132c91d83d97957e8c939797257a2669f612cd7b8d2314fb
CRC32 4259EE74
ssdeep 768:7Y3/upD7O/pBcxYsbae6GIXb9pDX2b98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3+sG+:yuBOx6baIa9RPj00ljEwzGi1dDaDYgS
Yara
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
5.tcp.eu.ngrok.io 3.67.161.133
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:62576 -> 164.124.101.2:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:64530 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:53673 -> 164.124.101.2:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:56613 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:62576 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:64530 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:53673 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:62576 -> 164.124.101.2:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:53673 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:62576 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:56613 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:64530 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:62576 -> 164.124.101.2:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:62576 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:64530 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:56613 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:53673 -> 164.124.101.2:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:62576 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:56613 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:53673 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:56613 -> 164.124.101.2:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:50674 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:53673 -> 164.124.101.2:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:56613 -> 164.124.101.2:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:50674 -> 164.124.101.2:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:53673 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:56613 -> 164.124.101.2:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:50674 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:53658 -> 164.124.101.2:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:50674 -> 164.124.101.2:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:64178 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:53658 -> 164.124.101.2:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:50674 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:64178 -> 164.124.101.2:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:53658 -> 164.124.101.2:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:50674 -> 164.124.101.2:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:64178 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:50674 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:64178 -> 164.124.101.2:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:64178 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:64178 -> 164.124.101.2:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:64178 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:64530 -> 164.124.101.2:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:64530 -> 164.124.101.2:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:64530 -> 164.124.101.2:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:53658 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:53658 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:53658 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity
UDP 192.168.56.103:53658 -> 8.8.8.8:53 2022642 ET INFO DNS Query to a *.ngrok domain (ngrok.io) Misc activity

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

WriteConsoleA

 buffer: IMPORTANT: Command executed successfully. However, "netsh firewall" is deprecated; use "netsh advfirewall firewall" instead. For more information on using "netsh advfirewall firewall" commands instead of "netsh firewall", see KB article 947709 at http://go.microsoft.com/fwlink/?linkid=121488 .
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Ok.
console_handle: 0x00000007
1 1 0
Bkav W32.PrimeaClefAF.Trojan
Lionic Trojan.Win32.Bladabindi.4!c
Elastic Windows.Trojan.Njrat
CAT-QuickHeal Trojan.YakbeexMSIL.ZZ4
Skyhigh BehavesLike.Win32.Trojan.nm
ALYac Trojan.GenericKD.65652599
Cylance Unsafe
VIPRE Trojan.GenericKD.65652599
Sangfor Suspicious.Win32.Save.a
K7AntiVirus EmailWorm ( 00555f371 )
BitDefender Trojan.GenericKD.65652599
K7GW EmailWorm ( 00555f371 )
Cybereason malicious.d7e797
Arcabit Trojan.Generic.D3E9C777
VirIT Trojan.Win32.MulDrop7.DOQR
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/Autorun.Spy.Agent.R
APEX Malicious
McAfee Trojan-FUTJ!4548851D7E79
Avast Win32:KeyloggerX-gen [Trj]
ClamAV Win.Packed.Generic-9795615-0
Kaspersky HEUR:Trojan.Win32.Generic
Alibaba Backdoor:MSIL/Autorun.6aff0028
NANO-Antivirus Trojan.Win32.TrjGen.dkmeat
MicroWorld-eScan Trojan.GenericKD.65652599
Rising Backdoor.njRAT!1.A096 (CLASSIC)
Emsisoft Trojan.GenericKD.65652599 (B)
F-Secure Trojan.TR/Dropper.Gen
DrWeb Trojan.MulDrop7.62625
Zillya Worm.AutoRun.Win32.50
TrendMicro Backdoor.MSIL.BLADABINDI.SMJJ
McAfeeD Real Protect-LS!4548851D7E79
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.4548851d7e7973d5
Sophos Mal/ILAgent-E
Ikarus Trojan.Inject
Jiangmin Trojan.Generic.hrywi
Webroot W32.Trojan.GenKD
Google Detected
Avira TR/Dropper.Gen
Antiy-AVL Trojan[Backdoor]/MSIL.Bladabindi
Kingsoft Win32.Trojan.Generic.a
Gridinsoft Ransom.Win32.Bladabindi.oa!s1
Microsoft Backdoor:MSIL/Bladabindi!rfn
ViRobot Trojan.Win.Z.Bladabindi.95232.F
ZoneAlarm HEUR:Trojan.Win32.Generic
GData MSIL.Backdoor.Agent.AXJ
Varist W32/Trojan.BVX.gen!Eldorado
AhnLab-V3 Trojan/Win32.Bladabindi.R295982
BitDefenderTheta Gen:NN.ZemsilF.36806.fiW@aOIGdLl