Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Dec. 18, 2024, 6:17 p.m.	Dec. 18, 2024, 6:25 p.m.

Size	124.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`2b252fcee2eec5371a13e6615abfcc22`
SHA256	`a056dcd40c2bc02637f0d35bb5558d84f4adbc5b2f61f0452bf0067da97d2041`
CRC32	`868AB125`
ssdeep	`3072:3dUmIYSBYZuziT7Sgmu1ErYn/YoZ3SNqbZidU1epo:GBY7yASgb1ErY3Z3zodUwpo`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) Win_Amadey_Zero - Amadey bot IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
2060
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,Main
2144
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,
2236
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
792

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
62.60.226.15	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Dec. 18, 2024, 6:17 p.m.			0	0
IsDebuggerPresent Dec. 18, 2024, 6:17 p.m.			0	0
IsDebuggerPresent Dec. 18, 2024, 6:17 p.m.			0	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header, Connection to IP address

suspicious_request

POST http://62.60.226.15/8fj482jd9/index.php

Performs some HTTP requests (1 event)

request

POST http://62.60.226.15/8fj482jd9/index.php

Sends data using the HTTP POST Method (1 event)

request

POST http://62.60.226.15/8fj482jd9/index.php

Allocates read-write-execute memory (usually to unpack itself) (19 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Dec. 18, 2024, 6:17 p.m.	process_identifier: 2060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744c6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 18, 2024, 6:17 p.m.	process_identifier: 2060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 18, 2024, 6:17 p.m.	process_identifier: 2060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 18, 2024, 6:17 p.m.	process_identifier: 2060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 18, 2024, 6:17 p.m.	process_identifier: 2060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74440000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 18, 2024, 6:17 p.m.	process_identifier: 2060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 18, 2024, 6:17 p.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744c6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 18, 2024, 6:17 p.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 18, 2024, 6:17 p.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 18, 2024, 6:17 p.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 18, 2024, 6:17 p.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74440000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 18, 2024, 6:17 p.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 18, 2024, 6:17 p.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 18, 2024, 6:17 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744c6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 18, 2024, 6:17 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 18, 2024, 6:17 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 18, 2024, 6:17 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 18, 2024, 6:17 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74440000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 18, 2024, 6:17 p.m.	process_identifier: 792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1

Communicates with host for which no DNS query was performed (1 event)

host

62.60.226.15

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Bkav	W32.Common.B90A4FF8
Lionic	Trojan.Win32.ClipBanker.Z!c
MicroWorld-eScan	Gen:Variant.Zusy.446682
CAT-QuickHeal	Trojan.Ghanarava.1734506029bfcc22
Skyhigh	BehavesLike.Win32.NetLoader.ch
McAfee	Artemis!2B252FCEE2EE
Cylance	Unsafe
VIPRE	Gen:Variant.Lazy.623345
Sangfor	Banker.Win32.Clipbanker.Vlul
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Zusy.446682
K7GW	Trojan ( 005b155f1 )
K7AntiVirus	Trojan ( 005b155f1 )
Arcabit	Trojan.Lazy.D982F1
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/ClipBanker.SJ
Avast	Win32:TrojanX-gen [Trj]
Cynet	Malicious (score: 100)
Kaspersky	Trojan.Win32.Nymaim.cdjq
Alibaba	Trojan:Win32/Nymaim.2beb5e58
NANO-Antivirus	Trojan.Win32.Nymaim.kuavkx
Emsisoft	Gen:Variant.Zusy.446682 (B)
F-Secure	Trojan.TR/ClipBanker.gjdgq
DrWeb	Trojan.PWS.Amadey.18
TrendMicro	TROJ_GEN.R002C0DLG24
McAfeeD	ti!A056DCD40C2B
CTX	dll.trojan.clipbanker
Sophos	Troj/Amadey-Gen
FireEye	Gen:Variant.Zusy.446682
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/ClipBanker.gjdgq
Antiy-AVL	Trojan/Win32.Amadey
Kingsoft	Win32.Troj.Unknown.a
Gridinsoft	Ransom.Win32.Banker.sa
Microsoft	Trojan:Win32/Amadey.MA!MTB
ViRobot	Trojan.Win.Z.Lazy.126976.FHY
GData	Win32.Trojan-Stealer.Amadey.F
AhnLab-V3	Trojan/Win.Amadey.C5684740
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.ClipBanker
Ikarus	Trojan.Win32.Clipbanker
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R002C0DLG24
Tencent	Win32.Trojan.Nymaim.Cflw
huorong	TrojanSpy/ClipBanker.y
Fortinet	W32/ClipBanker.SJ!tr
AVG	Win32:TrojanX-gen [Trj]
Paloalto	generic.ml

clip64.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All