popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

setup.exe

Generic Malware Malicious Library Antivirus UPX Malicious Packer OS Processor Check PE32 PE File CAB
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us March 26, 2025, 11:10 a.m. March 26, 2025, 11:14 a.m.
Size 3.9MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 baa233893561d2c4bbd4d2519909e5f6
SHA256 39d6c2455cdf6ef9b7b96cbf6172d1a8d3b9d5719b79ff44d47697ec40f7e209
CRC32 A6A9392C
ssdeep 98304:L0Fxb8yuO+WFwLId3DUVxaZumRdhfCqcqmP/tF:L0Fxb8yuO+JLA3DUuq
PDB Path C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • Antivirus - Contains references to security software
  • CAB_file_format - CAB archive file
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
pub-c7b31ab9decd4a2684fcd9fc90862261.r2.dev
A 172.66.0.235
A 162.159.140.237
162.159.140.237
x1.i.lencr.org
CNAME crl.root-x1.letsencrypt.org.edgekey.net
CNAME e8652.dscx.akamaiedge.net
A 23.41.113.98
23.52.33.11
IP Address Status Action
164.124.101.2 Active Moloch
172.66.0.235 Active Moloch
23.41.113.98 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49161 -> 172.66.0.235:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49161
172.66.0.235:443 		C=US, O=Let's Encrypt, CN=R11 CN=*.r2.dev aa:79:da:cd:20:a6:72:e4:79:6f:4a:2a:74:7a:e5:95:5e:1c:21:4e

pdb_path C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .didat
section .fptable
request GET http://x1.i.lencr.org/
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

RegSetValueExA

 key_handle: 0x0000039c
regkey_r: ProxyEnable
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
1 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob
Lionic Trojan.Win32.Generic.4!c
CAT-QuickHeal cld.trojan.fragtor
ALYac Gen:Variant.Zusy.587035
Cylance Unsafe
VIPRE Gen:Variant.Zusy.587035
BitDefender Gen:Variant.Zusy.587035
Arcabit Trojan.Zusy.D8F51B
Symantec Trojan Horse
Avast FileRepMalware [Misc]
MicroWorld-eScan Gen:Variant.Zusy.587035
Emsisoft Gen:Variant.Zusy.587035 (B)
McAfeeD ti!39D6C2455CDF
CTX exe.trojan.fragtor
FireEye Gen:Variant.Zusy.587035
Webroot Win.Trojan.Gen
Google Detected
Antiy-AVL Trojan/Win32.Agent
GData Gen:Variant.Zusy.587035
Varist W32/ABTrojan.DJTS-2846
AhnLab-V3 Malware/Win.Generic.C5743772
McAfee Artemis!BAA233893561
DeepInstinct MALICIOUS
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R014H09CM25
MaxSecure Trojan.Malware.325361894.susgen
Fortinet W32/PossibleThreat
AVG FileRepMalware [Misc]