popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Newtroop225.exe

info stealer Generic Malware browser email stealer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 16, 2021, 10:54 a.m. March 16, 2021, 10:54 a.m.
Size 632.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 08709f9689c1f83f421dc0d4de3fec36
SHA256 7a13f0c897638d4741e7936fa15e0e46c9a328406a43146fe4c2bf786b542087
CRC32 27D8121F
ssdeep 12288:uZgsq77sV5Z5QkeUzzirzqzUsDOr2Hc9pUl02TBg5Dui3EFSIKD:uZgsBTQLUz8uzUEOr2Hc/UZTBaDUSr
Yara
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • Generic_Malware_Zero - Generic Malware
  • win_files_operation - Affect private profile
  • IsPE32 - (no description)
  • IsWindowsGUI - (no description)
  • IsPacked - Entropy Check
  • HasRichSignature - Rich Signature Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

resource name None
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2232
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 397312
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c8a000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 614400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_CURSOR language LANG_TURKISH filetype dBase III DBT, version number 0, next free block index 40, 1st item "\251\317" sublanguage SUBLANG_DEFAULT offset 0x0273ec78 size 0x000008a8
name RT_CURSOR language LANG_TURKISH filetype dBase III DBT, version number 0, next free block index 40, 1st item "\251\317" sublanguage SUBLANG_DEFAULT offset 0x0273ec78 size 0x000008a8
name RT_CURSOR language LANG_TURKISH filetype dBase III DBT, version number 0, next free block index 40, 1st item "\251\317" sublanguage SUBLANG_DEFAULT offset 0x0273ec78 size 0x000008a8
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x0273d770 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x0273d770 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x0273d770 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x0273d770 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x0273d770 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x0273d770 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x0273d770 size 0x00000468
name RT_DIALOG language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x0273f718 size 0x000000c8
name RT_STRING language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x0273fb98 size 0x00000180
name RT_STRING language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x0273fb98 size 0x00000180
name RT_STRING language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x0273fb98 size 0x00000180
name RT_ACCELERATOR language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x0273dc40 size 0x00000030
name RT_GROUP_CURSOR language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x0273f520 size 0x00000022
name RT_GROUP_CURSOR language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x0273f520 size 0x00000022
name RT_GROUP_ICON language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x0273dbd8 size 0x00000068
name RT_VERSION language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x0273f548 size 0x000001d0
name None language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x0273dc70 size 0x0000000a
section {u'size_of_data': u'0x0006b400', u'virtual_address': u'0x00029000', u'entropy': 7.8608332795239795, u'name': u'.rdata', u'virtual_size': u'0x0006b2d8'} entropy 7.86083327952 description A section with a high entropy has been found
entropy 0.679334916865 description Overall entropy of this PE file is high
description email clients info stealer rule infoStealer_emailClients_Zero
description Code injection with CreateRemoteThread in a remote process rule inject_thread
description Create a windows service rule create_service
description Communications over UDP network rule network_udp_sock
description Listen for incoming communication rule network_tcp_listen
description Communications over P2P network rule network_p2p_win
description Communications over HTTP rule network_http
description File downloader/dropper rule network_dropper
description Communications over FTP rule network_ftp
description Communications over RAW socket rule network_tcp_socket
description Communications use DNS rule network_dns
description Communication using dga rule network_dga
description Escalade priviledges rule escalate_priv
description Take screenshot rule screenshot
description Run a keylogger rule keylogger
description Steal credential rule cred_local
description Record Audio rule sniff_audio
description APC queue tasks migration rule migrate_apc
description Malware can spread east-west using share drive rule spreading_share
description Create or check mutex rule win_mutex
description Affect system registries rule win_registry
description Affect system token rule win_token
description Affect private profile rule win_private_profile
description Affect private profile rule win_files_operation
description Match Winsock 2 API library declaration rule Str_Win32_Winsock2_Library
description Match Windows Inet API library declaration rule Str_Win32_Wininet_Library
description Match Windows Inet API call rule Str_Win32_Internet_API
description Match Windows Http API call rule Str_Win32_Http_API
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description browser info stealer rule infoStealer_browser_Zero
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.36506261
McAfee GenericRXAA-AA!08709F9689C1
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 005792e11 )
K7GW Trojan ( 005792e11 )
Cyren W32/Kryptik.DPT.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:DropperX-gen [Drp]
Kaspersky Trojan.Win32.Chapak.ezcr
BitDefender Trojan.GenericKD.36506261
NANO-Antivirus Trojan.Win32.Chapak.ipcxfw
Paloalto generic.ml
AegisLab Trojan.Multi.Generic.4!c
Tencent Win32.Trojan.Chapak.Frs
Ad-Aware Trojan.GenericKD.36506261
Sophos Mal/Generic-S
McAfee-GW-Edition BehavesLike.Win32.Generic.jc
FireEye Generic.mg.08709f9689c1f83f
Emsisoft Trojan.GenericKD.36506261 (B)
SentinelOne Static AI - Malicious PE
ESET-NOD32 a variant of Win32/Kryptik.HJXV
Webroot W32.Trojan.Gen
MAX malware (ai score=99)
Kingsoft Win32.Troj.Chapak.ez.(kcloud)
Microsoft Trojan:Win32/Glupteba!ml
GData Trojan.GenericKD.36506261
Cynet Malicious (score: 100)
Acronis suspicious
BitDefenderTheta Gen:NN.ZexaF.34608.Nq0@aei6sxnG
ALYac Trojan.GenericKDZ.73501
Malwarebytes MachineLearning/Anomalous.97%
Rising Trojan.Kryptik!8.8 (CLOUD)
Ikarus Trojan.Win32.Crypt
eGambit Unsafe.AI_Score_99%
MaxSecure Trojan.Malware.300983.susgen
AVG Win32:DropperX-gen [Drp]
Panda Trj/Genetic.gen
CrowdStrike win/malicious_confidence_100% (W)