popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Client.exe

.NET framework(MSIL) Malicious Library UPX Malicious Packer PE File PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 14, 2025, 10:32 a.m. April 14, 2025, 10:39 a.m.
Size 348.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 877b6f54cc162886869c665fb55be9e4
SHA256 a76e07e94dc79d6d45d1ce5e22ea9915b52ad14533e521484b5b5b7e824702a5
CRC32 DB52F52D
ssdeep 6144:s2NHXf500MACNOCQ5TLbg8841Y2a2nUj+dV2:Dd5070gO9a2nUqV2
Yara
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
ip-api.com
A 208.95.112.1
208.95.112.1
IP Address Status Action
164.124.101.2 Active Moloch
185.246.113.135 Active Moloch
208.95.112.1 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2054141 ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com) Device Retrieving External IP Address Detected
TCP 192.168.56.101:49163 -> 208.95.112.1:80 2036383 ET MALWARE Common RAT Connectivity Check Observed A Network Trojan was detected
TCP 192.168.56.101:49163 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected

Suricata TLS

No Suricata TLS

request GET http://ip-api.com/json/
domain ip-api.com
host 185.246.113.135
Bkav W32.AIDetectMalware.CS
Lionic Trojan.MSIL.Agent.mCnJ
CAT-QuickHeal Trojan.Ghanarava.17443571505be9e4
Skyhigh BehavesLike.Win32.TrojanAitInject.fh
ALYac Generic.MSIL.PasswordStealerA.950BC364
Cylance Unsafe
VIPRE Generic.MSIL.PasswordStealerA.950BC364
Sangfor Suspicious.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Generic.MSIL.PasswordStealerA.950BC364
K7GW Trojan ( 00521dab1 )
K7AntiVirus Trojan ( 00521dab1 )
Arcabit Generic.MSIL.PasswordStealerA.950BC364
VirIT Trojan.Win32.MSIL_Heur.B
Symantec ML.Attribute.HighConfidence
Elastic Windows.Trojan.Quasarrat
ESET-NOD32 a variant of MSIL/Spy.Agent.AES
APEX Malicious
Avast MSIL:Rat-B [Trj]
ClamAV Win.Packed.Generic-9829635-0
Kaspersky Trojan.MSIL.Agent.foww
Alibaba Trojan:MSIL/Zaquar.b6956376
NANO-Antivirus Trojan.Win32.FCOI.kvzykm
SUPERAntiSpyware Trojan.Agent/Gen-PasswordStealer
MicroWorld-eScan Generic.MSIL.PasswordStealerA.950BC364
Rising Backdoor.xRAT!1.D01D (CLASSIC)
Emsisoft Generic.MSIL.PasswordStealerA.950BC364 (B)
F-Secure Trojan:w32/QuasarRAT.A1
DrWeb Trojan.DownLoader27.59888
Zillya Trojan.Agent.Win32.743089
TrendMicro TSPY_TINCLEX.SM1
McAfeeD Real Protect-LS!877B6F54CC16
Trapmine malicious.moderate.ml.score
CTX exe.trojan.msil
Sophos ATK/Zaquar-D
SentinelOne Static AI - Malicious PE
Jiangmin Trojan.Generic.ajfvk
Webroot W32.Malware.Gen
Google Detected
Avira HEUR/AGEN.1307329
Antiy-AVL Trojan[Spy]/Win32.Agent.foqx
Kingsoft malware.kb.c.1000
Xcitium Malware@#2617ao39uxqeb
Microsoft Backdoor:MSIL/Quasar.GG!MTB
ViRobot Trojan.Win.S.Agent.356352
ZoneAlarm ATK/Zaquar-D
GData MSIL.Backdoor.Quasar.D
Varist W32/MSIL_Mintluks.A.gen!Eldorado
AhnLab-V3 Trojan/Win32.Subti.R285137
McAfee PWS-FCOI!877B6F54CC16