popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

bitcoin3000.exe

Emotet Gen1 Malicious Library UPX PE64 PE File CAB
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Feb. 10, 2025, 4:13 p.m. Feb. 10, 2025, 4:19 p.m.
Size 184.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 1e039f12c51a941bb072c73fe2def232
SHA256 20a3dec03b753524d7a21d828215d1ab9e7aa3b3daab783dd626c02231186556
CRC32 E674A666
ssdeep 3072:3MobR7ezAjLOZvmX1Ws5GWp1icKAArDZz4N9GhbkrNEk47vmV53:8eR7eammRp0yN90QE1+
PDB Path wextract.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
  • CAB_file_format - CAB archive file
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
95.217.25.45 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: 'appbitcoin.bat' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x000000000000000b
1 1 0
pdb_path wextract.pdb
resource name AVI
name RT_DIALOG language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x00028a68 size 0x0000010e
name RT_DIALOG language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x00028a68 size 0x0000010e
name RT_DIALOG language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x00028a68 size 0x0000010e
name RT_DIALOG language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x00028a68 size 0x0000010e
name RT_DIALOG language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x00028a68 size 0x0000010e
name RT_DIALOG language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x00028a68 size 0x0000010e
name RT_DIALOG language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x00028a68 size 0x0000010e
name RT_DIALOG language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x00028a68 size 0x0000010e
name RT_DIALOG language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x00028a68 size 0x0000010e
name RT_DIALOG language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x00028a68 size 0x0000010e
name RT_DIALOG language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x00028a68 size 0x0000010e
name RT_DIALOG language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x00028a68 size 0x0000010e
name RT_STRING language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x0002bb8c size 0x000003b4
name RT_STRING language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x0002bb8c size 0x000003b4
name RT_STRING language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x0002bb8c size 0x000003b4
name RT_STRING language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x0002bb8c size 0x000003b4
name RT_STRING language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x0002bb8c size 0x000003b4
name RT_STRING language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x0002bb8c size 0x000003b4
name RT_STRING language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x0002bb8c size 0x000003b4
name RT_STRING language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x0002bb8c size 0x000003b4
name RT_STRING language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x0002bb8c size 0x000003b4
name RT_STRING language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x0002bb8c size 0x000003b4
name RT_STRING language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x0002bb8c size 0x000003b4
name RT_STRING language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x0002bb8c size 0x000003b4
name RT_VERSION language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x0002c780 size 0x00000444
name RT_VERSION language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x0002c780 size 0x00000444
file C:\Users\test22\AppData\Local\Temp\IXP000.TMP\APPBIT~1.BAT
section {u'size_of_data': u'0x0001f000', u'virtual_address': u'0x0000f000', u'entropy': 6.8063380512067795, u'name': u'.rsrc', u'virtual_size': u'0x0001f000'} entropy 6.80633805121 description A section with a high entropy has been found
entropy 0.688888888889 description Overall entropy of this PE file is high
host 95.217.25.45
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 reg_value rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
Bkav W32.Common.112AC9F5
Lionic Trojan.Win32.ReverseShell.4!c
MicroWorld-eScan Trojan.Generic.37175218
Cylance Unsafe
VIPRE Trojan.Generic.37175218
CrowdStrike win/malicious_confidence_100% (W)
K7GW Trojan ( 00599bc41 )
K7AntiVirus Trojan ( 00599bc41 )
Symantec Trojan Horse
ESET-NOD32 PowerShell/ReverseShell.BD
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 99)
Alibaba Backdoor:Script/ReverseShell.00d1c16f
NANO-Antivirus Trojan.Win64.PowerShell.kuannz
Rising Backdoor.Agent/PS!1.FF8D (CLASSIC)
F-Secure Exploit.EXP/YAV.Minerva.tcbde
McAfeeD ti!20A3DEC03B75
Ikarus Trojan.Script
Webroot
Avira TR/ReverseShell.epnfc
Kingsoft Win32.Troj.Unknown.a
Microsoft Trojan:Win32/Etset!rfn
Google Detected
AhnLab-V3 Trojan/Win.SNH-gen.C5728081
Malwarebytes Trojan.Dropper.WXT
Tencent Win32.Backdoor.Agent.Ctgl
DeepInstinct MALICIOUS
alibabacloud Spy:Win/TRSpy