popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

utkin.exe

Generic Malware Malicious Library UPX Malicious Packer PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Jan. 13, 2025, 2:58 p.m. Jan. 13, 2025, 4:29 p.m.
Size 2.6MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 119891f3f60e7bba10a6b60731a8d211
SHA256 ad9b276a5d2f75e7d1c6b21f95d8a7cb70f482f2621847bca4864d90753de72f
CRC32 4E19C319
ssdeep 24576:V9L8hJZ4uB+Ch0lhSMXl72x+GsNompILTDyWD5Q:PL8hD4aurpompILTDyz
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE64 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
193.3.19.151 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2380
region_size: 1314816
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002070000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
host 193.3.19.151
dead_host 193.3.19.151:15666
Bkav W32.Common.B2C94C2D
Lionic Trojan.Win64.Stealer.tsIK
CAT-QuickHeal Trojanpws.Win64
Skyhigh BehavesLike.Win64.Meduza.vz
ALYac Trojan.GenericKD.75268215
Cylance Unsafe
VIPRE Trojan.GenericKD.75268215
Sangfor Infostealer.Win64.Kryptik.V4zx
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Trojan.GenericKD.75268215
K7GW Trojan ( 005bca991 )
K7AntiVirus Trojan ( 005bca991 )
Arcabit Trojan.Generic.D47C8077
VirIT Trojan.Win64.Agent.GBF
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win64/GenKryptik.HDHG
APEX Malicious
Avast Win64:MalwareX-gen [Trj]
Kaspersky Trojan-PSW.Win64.Stealer.akpo
Alibaba TrojanPSW:Win64/Stealer.a6ca1662
NANO-Antivirus Trojan.Win64.GenKryptik.kudubv
MicroWorld-eScan Trojan.GenericKD.75268215
Rising Stealer.Agent!8.C2 (TFE:5:H0SuumTg3ZU)
Emsisoft Trojan.GenericKD.75268215 (B)
F-Secure Trojan.TR/Crypt.Agent.klxhs
DrWeb Trojan.Siggen30.2652
Zillya Trojan.GenKryptik.Win64.44615
TrendMicro TrojanSpy.Win64.MEDUZASTEALER.YXELTZ
McAfeeD ti!AD9B276A5D2F
CTX exe.trojan.stealer
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
FireEye Generic.mg.119891f3f60e7bba
Webroot Win.Trojan.Meduza
Google Detected
Avira TR/Crypt.Agent.klxhs
Antiy-AVL Trojan[PSW]/Win64.Stealer
Kingsoft Win32.Troj.Unknown.a
Xcitium Malware@#2oc15ss5zfx74
Microsoft Trojan:Win64/MeduzaStealer.AJ!MTB
ViRobot Trojan.Win.Z.Genkryptik.2749952
GData Trojan.GenericKD.75268215
Varist W64/ABTrojan.TTAK-7533
McAfee Artemis!119891F3F60E
DeepInstinct MALICIOUS
VBA32 TrojanPSW.Win64.Stealer
Malwarebytes Malware.AI.290266122
Ikarus Trojan.Win64.Krypt
Panda Trj/Chgt.AD