Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 17, 2025, 9:41 a.m.	March 17, 2025, 10:28 a.m.

Size	12.5MB
Type	PE32+ executable (console) x86-64, for MS Windows
MD5	`f41df923bb7ba75f142c72a93d359c51`
SHA256	`70de579638ee31bc86e762067637e5f45185f3054ed4850c204dffc33d5eb5c1`
CRC32	`720B9ED5`
ssdeep	`393216:qgZ3/yYlFHmp+2JtWNhqKVadQOluwF3MnG38Ho+aYrb6gfH:qgZ3/blFX2JtEhqKVadQm3MGsHopq`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE64 - (no description) Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file

client.exe "C:\Users\test22\AppData\Local\Temp\client.exe"
2540
- client.exe "C:\Users\test22\AppData\Local\Temp\client.exe"
  2732

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 17, 2025, 9:41 a.m.			0	0

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 17, 2025, 9:41 a.m.		1	1	0

section

.fptable

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory March 17, 2025, 9:41 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1	0	0

file	C:\Users\test22\AppData\Local\Temp\_MEI25402\libcrypto-1_1.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI25402\python311.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI25402\python3.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI25402\libssl-1_1.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI25402\VCRUNTIME140.dll

section

{u'size_of_data': u'0x0000f000', u'virtual_address': u'0x0004a000', u'entropy': 7.35014558701962, u'name': u'.rsrc', u'virtual_size': u'0x0000ef8c'}

entropy

7.35014558702

description

A section with a high entropy has been found

Lionic	Trojan.Win32.Python.4!c
Skyhigh	BehavesLike.Win64.Backdoor.rc
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_90% (W)
Symantec	Trojan.Gen.MBT
ESET-NOD32	Python/TeleBot.CP
APEX	Malicious
Avast	Python:Agent-ACY [Trj]
Kaspersky	UDS:DangerousObject.Multi.Generic
Alibaba	Backdoor:Application/TeleBot.0790fef0
McAfeeD	ti!70DE579638EE
CTX	exe.trojan.python
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Google	Detected
Antiy-AVL	RiskWare/Win32.Kryptik.a
Varist	W64/ABApplication.OADZ-0882
McAfee	Artemis!F41DF923BB7B
DeepInstinct	MALICIOUS
Panda	Trj/Chgt.AD
Fortinet	W32/TeleBot.CP!tr
AVG	Python:Agent-ACY [Trj]
alibabacloud	Backdoor:Python/TeleBot.CX

client.exe