Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 27, 2024, 11:47 a.m.	Oct. 27, 2024, 12:02 p.m.

Size	124.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`9fcac34b8162651f29288e1ffff9394d`
SHA256	`61e770436568881a68dc2c4db3e84f33a89f5d7068f5988582c133cbe7c9519c`
CRC32	`7F6D24B5`
ssdeep	`3072:odUmIYSBYZuziT7Sgmu1ErYn/YoZ3SNq0l9ZidU1epo:TBY7yASgb1ErY3Z309odUwpo`
Yara	Win_Amadey_Zero - Amadey bot Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
2136
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
1212
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,Main
2224
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,
2324

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.215.113.217	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 27, 2024, 11:47 a.m.			0	0
IsDebuggerPresent Oct. 27, 2024, 11:47 a.m.			0	0
IsDebuggerPresent Oct. 27, 2024, 11:47 a.m.			0	0

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 27, 2024, 11:47 a.m.	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744d6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2024, 11:47 a.m.	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2024, 11:47 a.m.	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2024, 11:47 a.m.	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2024, 11:47 a.m.	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74450000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2024, 11:47 a.m.	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74501000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2024, 11:47 a.m.	process_identifier: 1212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744d6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2024, 11:47 a.m.	process_identifier: 1212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2024, 11:47 a.m.	process_identifier: 1212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2024, 11:47 a.m.	process_identifier: 1212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2024, 11:47 a.m.	process_identifier: 1212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743d0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2024, 11:47 a.m.	process_identifier: 1212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2024, 11:47 a.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744d6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2024, 11:47 a.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2024, 11:47 a.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2024, 11:47 a.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2024, 11:47 a.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74450000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2024, 11:47 a.m.	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74501000 process_handle: 0xffffffff	1

Communicates with host for which no DNS query was performed (1 event)

host

185.215.113.217

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

185.215.113.217:80

File has been identified by 45 AntiVirus engines on VirusTotal as malicious (45 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.ClipBanker.Z!c
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Zusy.446682
Cylance	Unsafe
VIPRE	Gen:Variant.Zusy.446682
Sangfor	Banker.Win32.Clipbanker.Ve25
CrowdStrike	win/malicious_confidence_90% (D)
BitDefender	Gen:Variant.Zusy.446682
Arcabit	Trojan.Zusy.D6D0DA
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/ClipBanker.SJ
Avast	Win32:TrojanX-gen [Trj]
ClamAV	Win.Malware.Zusy-10015683-0
Kaspersky	Trojan.Win32.Agent.xbthua
Alibaba	Trojan:Win32/Amadey.ea777a67
MicroWorld-eScan	Gen:Variant.Zusy.446682
Rising	Trojan.ClipBanker!8.5FB (CLOUD)
Emsisoft	Gen:Variant.Zusy.446682 (B)
McAfeeD	ti!61E770436568
CTX	dll.trojan.clipbanker
Sophos	Mal/Generic-S
FireEye	Gen:Variant.Zusy.446682
Google	Detected
Avira	TR/ClipBanker.mljfp
Antiy-AVL	Trojan/Win32.Amadey
Kingsoft	Win32.Trojan.Agent.xbthua
Gridinsoft	Trojan.Win32.Amadey.tr
Microsoft	Trojan:Win32/Amadey.MA!MTB
ViRobot	Trojan.Win.Z.Zusy.126976.B
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Gen:Variant.Zusy.446682
Varist	W32/ABPWS.MXXF-8455
AhnLab-V3	Trojan/Win.Amadey.C5684740
McAfee	Artemis!9FCAC34B8162
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.ClipBanker
Ikarus	Win32.Outbreak
Panda	Trj/GdSda.A
huorong	TrojanSpy/ClipBanker.y
Fortinet	W32/ClipBanker.SJ!tr
AVG	Win32:TrojanX-gen [Trj]
Paloalto	generic.ml
alibabacloud	Trojan[Spy]:Win/ClipBanker.y

clip64.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All