popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

cozy.exe

Browser Login Data Stealer Generic Malware Malicious Library Downloader UPX Malicious Packer PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us March 11, 2025, 9:43 a.m. March 11, 2025, 9:45 a.m.
Size 487.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 d249e2b6f10508da70305bb27bbf43e6
SHA256 489a4758ea8e46736dc0f67da790eeba6d5244de889dcee5ff49dcd6e9929736
CRC32 1A3E30FC
ssdeep 6144:nIlSCa0RPvRz+n8Qr1D0ZGESuHabmvHOE4mCp6qtydBnP+Y4+3sAORZGFX3Xc6oJ:n200OFp+G0imvHn3Cp6qyBP+YdsvZGm
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • infoStealer_browser_b_Zero - browser info stealer
  • Malicious_Packer_Zero - Malicious Packer
  • Network_Downloader - File Downloader
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
remyma.duckdns.org
A 185.196.9.173
185.196.9.173
geoplugin.net
A 178.237.33.50
178.237.33.50
IP Address Status Action
164.124.101.2 Active Moloch
178.237.33.50 Active Moloch
185.196.9.173 Active Moloch

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header suspicious_request GET http://geoplugin.net/json.gp
domain remyma.duckdns.org
request GET http://geoplugin.net/json.gp
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Remcos.m!c
Cynet Malicious (score: 100)
CAT-QuickHeal Backdoor.Remcos
Skyhigh BehavesLike.Win32.Remcos.gh
ALYac Generic.Dacic.A9349469.A.57A1E868
Cylance Unsafe
VIPRE Generic.Dacic.A9349469.A.57A1E868
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Generic.Dacic.A9349469.A.57A1E868
K7GW Trojan ( 0053ac2c1 )
K7AntiVirus Trojan ( 0053ac2c1 )
Arcabit Generic.Dacic.A9349469.A.57A1E868
VirIT Trojan.Win32.Remcos.DFP
Symantec ML.Attribute.HighConfidence
Elastic Windows.Trojan.Remcos
ESET-NOD32 a variant of Win32/Rescoms.B
APEX Malicious
Avast Win32:RATX-gen [Trj]
ClamAV Win.Trojan.Remcos-9841897-0
Kaspersky HEUR:Backdoor.Win32.Remcos.gen
Alibaba Backdoor:Win32/Remcos.d7eec816
NANO-Antivirus Trojan.Win32.Remcos.kvsovm
MicroWorld-eScan Generic.Dacic.A9349469.A.57A1E868
Rising Backdoor.Remcos!1.BAC7 (CLASSIC)
Emsisoft Generic.Dacic.A9349469.A.57A1E868 (B)
F-Secure Backdoor.BDS/Backdoor.Gen
DrWeb BackDoor.Remcos.491
Zillya Trojan.Rescoms.Win32.2189
McAfeeD Real Protect-LS!D249E2B6F105
CTX exe.backdoor.remcos
Sophos Mal/Remcos-B
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.d249e2b6f10508da
Google Detected
Avira BDS/Backdoor.Gen
Antiy-AVL GrayWare/Win32.Wacapew
Kingsoft Win32.Hack.Remcos.gen
Gridinsoft Backdoor.Win32.Remcos.sa
Microsoft Backdoor:Win32/Remcos.GA!MTB
GData Generic.Dacic.A9349469.A.57A1E868
Varist W32/Agent.JUB.gen!Eldorado
AhnLab-V3 Backdoor/Win.Remcos.R693720
McAfee Artemis!D249E2B6F105
DeepInstinct MALICIOUS
VBA32 BScope.Backdoor.Remcos
Malwarebytes Backdoor.Remcos
Ikarus Trojan.Win32.Remcos
Panda Trj/Genetic.gen