popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Tellimine_554399744002227748.img

Process Kill Generic Malware FindFirstVolume Malicious Library CryptGenKey AntiDebug Device_File_Check OS Processor Check AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 8, 2025, 7:59 p.m. April 8, 2025, 8:01 p.m.
Size 1.4MB
Type UDF filesystem data (version 1.5) 'DESKTOP'
MD5 99dfdb455a6c1d016dee409a9ee999e3
SHA256 679efbb61657385f8f63218661ba167a6635c812794a152e523fd1f5ecf1014a
CRC32 AED463BC
ssdeep 24576:Cu6J33O0c+JY5UZ+XC0kGso6FaiVRtoCkEDWY:ku0c++OCvkGs9FaiVDfkXY
Yara
  • Malicious_Library_Zero - Malicious_Library
  • FindFirstVolume_Zero - FindFirstVolume Zero
  • CryptGenKey_Zero - CryptGenKey Zero
  • Process_Snapshot_Kill_Zero - Process Kill Zero
  • Device_Check_Zero - Device Check Zero
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00430000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73263000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72d92000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73fd3000
process_handle: 0xffffffff
1 0 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
ESET-NOD32 a variant of Win32/Injector.Autoit.GYU
TrendMicro-HouseCall Mal_GENISO-3
Kaspersky UDS:Trojan-Spy.MSIL.BPLogger
DrWeb Trojan.Siggen6.46904
TrendMicro Mal_GENISO-3
Sophos CXrep/ISO-A
Google Detected
Varist W32/AutoIt.OL.gen!Eldorado
AhnLab-V3 Trojan/AU3.Loader.S2970
VBA32 BScope.Trojan.Toga
Zoner Trojan.Win32.179540
huorong HEUR:TrojanSpy/AutoIT.Stealer.a
Fortinet AutoIt/Agent.GYT!tr