Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 4, 2025, 9:51 a.m.	April 4, 2025, 9:54 a.m.

Size	124.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`b7944be7b7f50acc36aa2e4e50b0b79c`
SHA256	`3198362b94f8d69ffa56226dc7d56d892dc5c592cdf267b939b54ac44c1b6e89`
CRC32	`7788BBF5`
ssdeep	`3072:eYZ27UeZm+wr7CImzEyv/Y4Z3SNqHUeVfYYOpf:fo7JfuCIsEyfZ3fUe1Ynpf`
Yara	PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library IsDLL - (no description) Win_Amadey_Zero - Amadey bot IsPE32 - (no description) Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
2560
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
2644
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,Main
2736
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,
2832

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
176.65.143.173	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 4, 2025, 9:51 a.m.			0	0
IsDebuggerPresent April 4, 2025, 9:51 a.m.			0	0
IsDebuggerPresent April 4, 2025, 9:51 a.m.			0	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header, Connection to IP address

suspicious_request

POST http://176.65.143.173/M0XmDru/index.php

Performs some HTTP requests (1 event)

request

POST http://176.65.143.173/M0XmDru/index.php

Sends data using the HTTP POST Method (1 event)

request

POST http://176.65.143.173/M0XmDru/index.php

Allocates read-write-execute memory (usually to unpack itself) (30 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73be6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73571000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734a4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73572000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73be6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73571000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734a4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73572000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73be6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73514000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 4, 2025, 9:51 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bb1000 process_handle: 0xffffffff	1

Communicates with host for which no DNS query was performed (1 event)

host

176.65.143.173

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 events)

Lionic	Trojan.Win32.Amadey.i!c
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojanpws.Kliper
Skyhigh	BehavesLike.Win32.AmadeyTrojan.ch
ALYac	Gen:Variant.Zusy.446682
Cylance	Unsafe
VIPRE	Gen:Variant.Zusy.446682
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Zusy.446682
K7GW	Trojan ( 005b155f1 )
K7AntiVirus	Trojan ( 005b155f1 )
Arcabit	Trojan.Zusy.D6D0DA
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/ClipBanker.SJ
Avast	Win32:TrojanX-gen [Trj]
ClamAV	Win.Malware.Zusy-10015683-0
Kaspersky	HEUR:Trojan-PSW.Win32.Kliper.gen
Alibaba	TrojanPSW:Win32/Amadey.362d21ed
NANO-Antivirus	Trojan.Win32.Kliper.kwarug
MicroWorld-eScan	Gen:Variant.Zusy.446682
Rising	Downloader.Amadey!1.1275B (CLASSIC)
Emsisoft	Gen:Variant.Zusy.446682 (B)
F-Secure	Trojan.TR/ClipBanker.canna
CTX	dll.trojan.amadey
Sophos	Troj/Amadey-Gen
FireEye	Gen:Variant.Zusy.446682
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/ClipBanker.canna
Antiy-AVL	Trojan/Win32.Amadey
Gridinsoft	Ransom.Win32.Banker.sa
Microsoft	Trojan:Win32/Amadey.MA!MTB
ZoneAlarm	Troj/Amadey-Gen
GData	Win32.Trojan-Stealer.Amadey.F
Varist	W32/ABTrojan.VYXC-5660
AhnLab-V3	Trojan/Win.Amadey.C5684740
McAfee	Artemis!B7944BE7B7F5
DeepInstinct	MALICIOUS
VBA32	TrojanPSW.Kliper
Malwarebytes	Trojan.ClipBanker
Ikarus	Trojan.Win32.Clipbanker
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Trojan.Win32.VSX.PE04C9V
Tencent	Malware.Win32.Gencirc.11df9703
huorong	TrojanSpy/ClipBanker.y
MaxSecure	Trojan.Malware.324988001.susgen
Fortinet	W32/ClipBanker.SJ!tr
AVG	Win32:TrojanX-gen [Trj]

clip64.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All