popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

nyoilsafkjawd.exe

Backdoor Client SW User Data Stealer Browser Login Data Stealer RemcosRAT info stealer Generic Malware browser Google UPX Chrome User Data Downloader Malicious Library Malicious Packer Escalate priviledges ScreenShot PWS Sniff Audio Create Service Socket
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 12, 2025, 11:25 a.m. March 12, 2025, 11:27 a.m.
Size 487.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0bea38a3f664f5c8d72ab74db022aacd
SHA256 fa1c16a3024d35ebc4f6996d1791ead89a08dae2ebd87e39c9997c04613c4645
CRC32 49415357
ssdeep 12288:P200OFp+G0imvHn3Cp6qyBP+YdsvZGH3:e0Zp+ViehBWY0ZS
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • infoStealer_browser_b_Zero - browser info stealer
  • Malicious_Packer_Zero - Malicious Packer
  • Network_Downloader - File Downloader
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
157.20.104.252 Active Moloch
91.135.156.200 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
description app.exe tried to sleep 356 seconds, actually delayed analysis time by 356 seconds
description Create a windows service rule Create_Service
description Client_SW_User_Data_Stealer rule Client_SW_User_Data_Stealer
description Win Backdoor RemcosRAT rule Win_Backdoor_RemcosRAT
description Communications over RAW Socket rule Network_TCP_Socket
description browser info stealer rule infoStealer_browser_Zero
description Take ScreenShot rule ScreenShot
description Escalate priviledges rule Escalate_priviledges
description Google Chrome User Data Check rule Chrome_User_Data_Check_Zero
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Communications use DNS rule Network_DNS
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description File Downloader rule Network_Downloader
description Match Windows Inet API call rule Str_Win32_Internet_API
description Run a KeyLogger rule KeyLogger
host 157.20.104.252
host 91.135.156.200
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\￐￬￪-HQT17V reg_value "C:\Users\test22\AppData\Roaming\firefox tsms\app.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\￐￬￪-HQT17V reg_value "C:\Users\test22\AppData\Roaming\firefox tsms\app.exe"
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\￐￬￪-HQT17V reg_value "C:\Users\test22\AppData\Roaming\firefox tsms\app.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\￐￬￪-HQT17V reg_value "C:\Users\test22\AppData\Roaming\firefox tsms\app.exe"
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: 
base_address: 0x7efde008
process_identifier: 2704
process_handle: 0x00000130
1 1 0
Time & API Arguments Status Return Repeated

SetWindowsHookExA

 thread_identifier: 0
callback_function: 0x00409d0a
hook_identifier: 13 (WH_KEYBOARD_LL)
module_address: 0x00400000
1 1835219 0
Process injection Process 2624 called NtSetContextThread to modify thread in remote process 2704
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 2161340
registers.edi: 0
registers.eax: 1396068
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000110
process_identifier: 2704
1 0 0
Process injection Process 2624 resumed a thread in remote process 2704
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000110
suspend_count: 1
process_identifier: 2704
1 0 0
dead_host 91.135.156.200:8109
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2628
thread_handle: 0x000003f8
process_identifier: 2624
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Roaming\firefox tsms\app.exe
track: 1
command_line: "C:\Users\test22\AppData\Roaming\firefox tsms\app.exe"
filepath_r: C:\Users\test22\AppData\Roaming\firefox tsms\app.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000404
1 1 0

CreateProcessInternalW

 thread_identifier: 2708
thread_handle: 0x00000110
process_identifier: 2704
current_directory:
filepath:
track: 1
command_line: rmclient.exe
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000130
1 1 0

NtGetContextThread

 thread_handle: 0x00000110
1 0 0

NtMapViewOfSection

 section_handle: 0x00000138
process_identifier: 2704
commit_size: 0
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
base_address: 0x00120000
allocation_type: 0 ()
section_offset: 0
view_size: 528384
process_handle: 0x00000130
1 0 0

WriteProcessMemory

 buffer: 
base_address: 0x7efde008
process_identifier: 2704
process_handle: 0x00000130
1 1 0

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 2161340
registers.edi: 0
registers.eax: 1396068
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000110
process_identifier: 2704
1 0 0

NtResumeThread

 thread_handle: 0x00000110
suspend_count: 1
process_identifier: 2704
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Remcos.m!c
Cynet Malicious (score: 100)
CAT-QuickHeal Trojan.Ghanarava.174171379522aacd
Skyhigh BehavesLike.Win32.Remcos.gh
ALYac Generic.Dacic.A9349469.A.2275F8BF
Cylance Unsafe
VIPRE Generic.Dacic.A9349469.A.2275F8BF
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Generic.Dacic.A9349469.A.2275F8BF
K7GW Trojan ( 0053ac2c1 )
K7AntiVirus Trojan ( 0053ac2c1 )
Arcabit Generic.Dacic.A9349469.A.2275F8BF
VirIT Trojan.Win32.Remcos.DFP
Symantec ML.Attribute.HighConfidence
Elastic Windows.Trojan.Remcos
ESET-NOD32 a variant of Win32/Rescoms.B
APEX Malicious
Avast Win32:RATX-gen [Trj]
ClamAV Win.Trojan.Remcos-9841897-0
Kaspersky HEUR:Backdoor.Win32.Remcos.gen
Alibaba Backdoor:Win32/Remcos.f9d9d4fd
NANO-Antivirus Trojan.Win32.Remcos.kvsovm
MicroWorld-eScan Generic.Dacic.A9349469.A.2275F8BF
Rising Backdoor.Remcos!1.BAC7 (CLASSIC)
Emsisoft Generic.Dacic.A9349469.A.2275F8BF (B)
F-Secure Backdoor.BDS/Backdoor.Gen
DrWeb BackDoor.Remcos.491
Zillya Trojan.Rescoms.Win32.2189
McAfeeD Real Protect-LS!0BEA38A3F664
CTX exe.trojan.remcos
Sophos Mal/Remcos-B
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.0bea38a3f664f5c8
Webroot Win.Backdoor.Remcos
Google Detected
Avira BDS/Backdoor.Gen
Antiy-AVL GrayWare/Win32.Wacapew
Kingsoft malware.kb.a.1000
Gridinsoft Trojan.Win32.Remcos.tr
Microsoft Backdoor:Win32/Remcos.GA!MTB
ZoneAlarm Mal/Remcos-B
GData Generic.Dacic.A9349469.A.2275F8BF
Varist W32/Agent.JUB.gen!Eldorado
AhnLab-V3 Backdoor/Win.Remcos.R693720
McAfee Artemis!0BEA38A3F664
DeepInstinct MALICIOUS
VBA32 Win32.Trojan.Dropper.Heur
Malwarebytes Backdoor.Remcos