ScreenShot
| Created | 2021.05.21 10:01 | Machine | s1_win7_x6402 |
| Filename | infostati2.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 21 detected (AIDetect, malware1, malicious, high confidence, Attribute, HighConfidence, ET#76%, RDMK, cmRtazr4JrxNmVLextotw62or3Ng, Lockbit, A + Mal, GandCrypt, Static AI, Malicious PE, Unsafe, Score, XPACK, Gen3, 14FJAB1, R418596, BScope, Wacatac, FakeAV, susgen, confidence) | ||
| md5 | 18b6e2c669dc078e297af35aaaa605fc | ||
| sha256 | 82b71a1fc1c575129b572ee2ec5f20e7008e373400b8f0ada298e073fe3d5112 | ||
| ssdeep | 12288:X4GKGRiSL8E8DuNlFGbuZerJgsBngki2fuzkwFSPysv+jqA5OM+SCpcBDSYrqHuj:XnRi47lAqZePngk5WzkwFSaljqAsMDSc | ||
| imphash | 5190db9e278edf55d3b5ab1608f0dbe5 | ||
| impfuzzy | 48:C5/GqORN4aopkaX1n/1WVnpV+fccOl968FH1acTSEljgD:iG1joDX1/UpV+fcca68F8cTSElM | ||
Network IP location
Signature (9cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 21 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| watch | Tries to unhook Windows functions monitored by Cuckoo |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | One or more processes crashed |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Trojan_Win32_Glupteba_1_Zero | Trojan Win32 Glupteba | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x424000 GetCommandLineW
0x424004 GetPrivateProfileSectionNamesW
0x424008 SetVolumeLabelA
0x42400c GetFileSize
0x424010 SetPriorityClass
0x424014 OpenFile
0x424018 WriteConsoleInputW
0x42401c WritePrivateProfileStructA
0x424020 GetConsoleAliasesLengthW
0x424024 CopyFileExW
0x424028 TlsGetValue
0x42402c GetDriveTypeW
0x424030 SetEndOfFile
0x424034 FindResourceExW
0x424038 LoadResource
0x42403c HeapAlloc
0x424040 SetUnhandledExceptionFilter
0x424044 SystemTimeToFileTime
0x424048 GetCommState
0x42404c ZombifyActCtx
0x424050 ScrollConsoleScreenBufferW
0x424054 WritePrivateProfileSectionA
0x424058 GetProfileStringW
0x42405c WaitForSingleObject
0x424060 SetComputerNameW
0x424064 OpenSemaphoreA
0x424068 FindFirstFileExW
0x42406c GetProcessPriorityBoost
0x424070 GetTickCount
0x424074 GetWindowsDirectoryA
0x424078 EnumTimeFormatsA
0x42407c GetSystemWow64DirectoryA
0x424080 SetProcessPriorityBoost
0x424084 GlobalAlloc
0x424088 GetConsoleMode
0x42408c TerminateThread
0x424090 GetPrivateProfileStructW
0x424094 GetSystemPowerStatus
0x424098 SetVolumeMountPointA
0x42409c GlobalFlags
0x4240a0 GetFileAttributesW
0x4240a4 SetTimeZoneInformation
0x4240a8 HeapQueryInformation
0x4240ac TerminateProcess
0x4240b0 GetTimeZoneInformation
0x4240b4 GetBinaryTypeW
0x4240b8 GetACP
0x4240bc lstrlenW
0x4240c0 SetThreadPriority
0x4240c4 CreateJobObjectA
0x4240c8 GetPrivateProfileIntW
0x4240cc GetLastError
0x4240d0 IsDBCSLeadByteEx
0x4240d4 SetLastError
0x4240d8 ReadConsoleOutputCharacterA
0x4240dc GetProcAddress
0x4240e0 SetComputerNameA
0x4240e4 OpenWaitableTimerA
0x4240e8 GetLocalTime
0x4240ec LoadLibraryA
0x4240f0 OpenThread
0x4240f4 OpenMutexA
0x4240f8 WriteConsoleA
0x4240fc ProcessIdToSessionId
0x424100 MoveFileA
0x424104 BuildCommDCBAndTimeoutsW
0x424108 SetConsoleOutputCP
0x42410c WriteProfileSectionW
0x424110 AddAtomA
0x424114 SetCommMask
0x424118 SetSystemTime
0x42411c SetConsoleCursorInfo
0x424120 DebugSetProcessKillOnExit
0x424124 GetProcessShutdownParameters
0x424128 ContinueDebugEvent
0x42412c CancelTimerQueueTimer
0x424130 EnumResourceNamesA
0x424134 RequestWakeupLatency
0x424138 VirtualProtect
0x42413c GetConsoleCursorInfo
0x424140 ReleaseMutex
0x424144 FindAtomW
0x424148 AddConsoleAliasA
0x42414c DebugBreak
0x424150 GetProfileSectionW
0x424154 GetVolumeInformationW
0x424158 InterlockedIncrement
0x42415c InterlockedDecrement
0x424160 InitializeCriticalSection
0x424164 DeleteCriticalSection
0x424168 EnterCriticalSection
0x42416c LeaveCriticalSection
0x424170 WideCharToMultiByte
0x424174 DeleteFileA
0x424178 EncodePointer
0x42417c DecodePointer
0x424180 GetCommandLineA
0x424184 HeapSetInformation
0x424188 GetStartupInfoW
0x42418c GetModuleFileNameW
0x424190 RaiseException
0x424194 IsProcessorFeaturePresent
0x424198 GetCurrentProcess
0x42419c UnhandledExceptionFilter
0x4241a0 IsDebuggerPresent
0x4241a4 GetOEMCP
0x4241a8 GetCPInfo
0x4241ac IsValidCodePage
0x4241b0 TlsAlloc
0x4241b4 TlsSetValue
0x4241b8 GetCurrentThreadId
0x4241bc TlsFree
0x4241c0 GetModuleHandleW
0x4241c4 InitializeCriticalSectionAndSpinCount
0x4241c8 SetStdHandle
0x4241cc GetFileType
0x4241d0 WriteFile
0x4241d4 GetConsoleCP
0x4241d8 HeapValidate
0x4241dc IsBadReadPtr
0x4241e0 ExitProcess
0x4241e4 QueryPerformanceCounter
0x4241e8 GetCurrentProcessId
0x4241ec GetSystemTimeAsFileTime
0x4241f0 GetModuleFileNameA
0x4241f4 FreeEnvironmentStringsW
0x4241f8 GetEnvironmentStringsW
0x4241fc SetHandleCount
0x424200 GetStdHandle
0x424204 HeapCreate
0x424208 OutputDebugStringA
0x42420c WriteConsoleW
0x424210 OutputDebugStringW
0x424214 LoadLibraryW
0x424218 RtlUnwind
0x42421c LCMapStringW
0x424220 MultiByteToWideChar
0x424224 GetStringTypeW
0x424228 SetFilePointer
0x42422c HeapReAlloc
0x424230 HeapSize
0x424234 HeapFree
0x424238 CreateFileW
0x42423c CloseHandle
0x424240 FlushFileBuffers
USER32.dll
0x424248 GetAncestor
0x42424c GetCursorInfo
EAT(Export Address Table) is none
KERNEL32.dll
0x424000 GetCommandLineW
0x424004 GetPrivateProfileSectionNamesW
0x424008 SetVolumeLabelA
0x42400c GetFileSize
0x424010 SetPriorityClass
0x424014 OpenFile
0x424018 WriteConsoleInputW
0x42401c WritePrivateProfileStructA
0x424020 GetConsoleAliasesLengthW
0x424024 CopyFileExW
0x424028 TlsGetValue
0x42402c GetDriveTypeW
0x424030 SetEndOfFile
0x424034 FindResourceExW
0x424038 LoadResource
0x42403c HeapAlloc
0x424040 SetUnhandledExceptionFilter
0x424044 SystemTimeToFileTime
0x424048 GetCommState
0x42404c ZombifyActCtx
0x424050 ScrollConsoleScreenBufferW
0x424054 WritePrivateProfileSectionA
0x424058 GetProfileStringW
0x42405c WaitForSingleObject
0x424060 SetComputerNameW
0x424064 OpenSemaphoreA
0x424068 FindFirstFileExW
0x42406c GetProcessPriorityBoost
0x424070 GetTickCount
0x424074 GetWindowsDirectoryA
0x424078 EnumTimeFormatsA
0x42407c GetSystemWow64DirectoryA
0x424080 SetProcessPriorityBoost
0x424084 GlobalAlloc
0x424088 GetConsoleMode
0x42408c TerminateThread
0x424090 GetPrivateProfileStructW
0x424094 GetSystemPowerStatus
0x424098 SetVolumeMountPointA
0x42409c GlobalFlags
0x4240a0 GetFileAttributesW
0x4240a4 SetTimeZoneInformation
0x4240a8 HeapQueryInformation
0x4240ac TerminateProcess
0x4240b0 GetTimeZoneInformation
0x4240b4 GetBinaryTypeW
0x4240b8 GetACP
0x4240bc lstrlenW
0x4240c0 SetThreadPriority
0x4240c4 CreateJobObjectA
0x4240c8 GetPrivateProfileIntW
0x4240cc GetLastError
0x4240d0 IsDBCSLeadByteEx
0x4240d4 SetLastError
0x4240d8 ReadConsoleOutputCharacterA
0x4240dc GetProcAddress
0x4240e0 SetComputerNameA
0x4240e4 OpenWaitableTimerA
0x4240e8 GetLocalTime
0x4240ec LoadLibraryA
0x4240f0 OpenThread
0x4240f4 OpenMutexA
0x4240f8 WriteConsoleA
0x4240fc ProcessIdToSessionId
0x424100 MoveFileA
0x424104 BuildCommDCBAndTimeoutsW
0x424108 SetConsoleOutputCP
0x42410c WriteProfileSectionW
0x424110 AddAtomA
0x424114 SetCommMask
0x424118 SetSystemTime
0x42411c SetConsoleCursorInfo
0x424120 DebugSetProcessKillOnExit
0x424124 GetProcessShutdownParameters
0x424128 ContinueDebugEvent
0x42412c CancelTimerQueueTimer
0x424130 EnumResourceNamesA
0x424134 RequestWakeupLatency
0x424138 VirtualProtect
0x42413c GetConsoleCursorInfo
0x424140 ReleaseMutex
0x424144 FindAtomW
0x424148 AddConsoleAliasA
0x42414c DebugBreak
0x424150 GetProfileSectionW
0x424154 GetVolumeInformationW
0x424158 InterlockedIncrement
0x42415c InterlockedDecrement
0x424160 InitializeCriticalSection
0x424164 DeleteCriticalSection
0x424168 EnterCriticalSection
0x42416c LeaveCriticalSection
0x424170 WideCharToMultiByte
0x424174 DeleteFileA
0x424178 EncodePointer
0x42417c DecodePointer
0x424180 GetCommandLineA
0x424184 HeapSetInformation
0x424188 GetStartupInfoW
0x42418c GetModuleFileNameW
0x424190 RaiseException
0x424194 IsProcessorFeaturePresent
0x424198 GetCurrentProcess
0x42419c UnhandledExceptionFilter
0x4241a0 IsDebuggerPresent
0x4241a4 GetOEMCP
0x4241a8 GetCPInfo
0x4241ac IsValidCodePage
0x4241b0 TlsAlloc
0x4241b4 TlsSetValue
0x4241b8 GetCurrentThreadId
0x4241bc TlsFree
0x4241c0 GetModuleHandleW
0x4241c4 InitializeCriticalSectionAndSpinCount
0x4241c8 SetStdHandle
0x4241cc GetFileType
0x4241d0 WriteFile
0x4241d4 GetConsoleCP
0x4241d8 HeapValidate
0x4241dc IsBadReadPtr
0x4241e0 ExitProcess
0x4241e4 QueryPerformanceCounter
0x4241e8 GetCurrentProcessId
0x4241ec GetSystemTimeAsFileTime
0x4241f0 GetModuleFileNameA
0x4241f4 FreeEnvironmentStringsW
0x4241f8 GetEnvironmentStringsW
0x4241fc SetHandleCount
0x424200 GetStdHandle
0x424204 HeapCreate
0x424208 OutputDebugStringA
0x42420c WriteConsoleW
0x424210 OutputDebugStringW
0x424214 LoadLibraryW
0x424218 RtlUnwind
0x42421c LCMapStringW
0x424220 MultiByteToWideChar
0x424224 GetStringTypeW
0x424228 SetFilePointer
0x42422c HeapReAlloc
0x424230 HeapSize
0x424234 HeapFree
0x424238 CreateFileW
0x42423c CloseHandle
0x424240 FlushFileBuffers
USER32.dll
0x424248 GetAncestor
0x42424c GetCursorInfo
EAT(Export Address Table) is none