ScreenShot
| Created | 2021.05.23 10:21 | Machine | s1_win7_x6402 |
| Filename | bin.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 30 detected (AIDetect, malware1, malicious, high confidence, Unsafe, Save, ZexaF, vuW@a8c7eqcG, Attribute, HighConfidence, GenKryptik, FFQO, BotX, Azorult, PWSZbot, Static AI, Malicious PE, susgen, XPACK, Gen3, score, Glupteba, R421770, Artemis, BScope, Wacatac, ET#76%, RDMK, cmRtazrx7dT5YE0czbfV91fdIG, FakeAV, Kryptik, HKZH, confidence, 100%) | ||
| md5 | edb386d29730158b61b5212b9b922a5a | ||
| sha256 | 5d191a5eeb7648a1806c9b42c64acd816678a3ce04d52a7cbc7da649b1902a04 | ||
| ssdeep | 6144:hj1BmMVfZgDQym1mtMo2N1cxPKv9P7582dGx4gaOgP+OMSnXsTRV:hjfmMV+DVmuG1zNQsPFnXsL | ||
| imphash | abbec4d8cc3408f46a61cf49a256a187 | ||
| impfuzzy | 48:CuGqOR/BmXopkaX18d1yVnpg+fcKOvEaEG+8FHATSsJgD:dG1yoDX1ispg+fcKcEG+8FgTSsa | ||
Network IP location
Signature (9cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 30 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| watch | Tries to unhook Windows functions monitored by Cuckoo |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | One or more processes crashed |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Trojan_Win32_Glupteba_1_Zero | Trojan Win32 Glupteba | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x424000 GetCommandLineW
0x424004 SetVolumeLabelA
0x424008 GetFileSize
0x42400c SetPriorityClass
0x424010 OpenFile
0x424014 WritePrivateProfileStructA
0x424018 CopyFileExW
0x42401c TlsGetValue
0x424020 GetDriveTypeW
0x424024 SetEndOfFile
0x424028 FindResourceExW
0x42402c LoadResource
0x424030 HeapAlloc
0x424034 SetUnhandledExceptionFilter
0x424038 SystemTimeToFileTime
0x42403c GetCommState
0x424040 ZombifyActCtx
0x424044 ScrollConsoleScreenBufferW
0x424048 WritePrivateProfileSectionA
0x42404c GetProfileStringW
0x424050 GetProfileSectionA
0x424054 WaitForSingleObject
0x424058 WriteConsoleInputA
0x42405c SetComputerNameW
0x424060 SetVolumeMountPointW
0x424064 FindFirstFileExW
0x424068 GetProcessPriorityBoost
0x42406c GetTickCount
0x424070 GetConsoleAliasesLengthA
0x424074 GetWindowsDirectoryA
0x424078 EnumTimeFormatsA
0x42407c GetSystemWow64DirectoryA
0x424080 SetProcessPriorityBoost
0x424084 GlobalAlloc
0x424088 GetConsoleMode
0x42408c TerminateThread
0x424090 GetPrivateProfileStructW
0x424094 GetSystemPowerStatus
0x424098 SetVolumeMountPointA
0x42409c GlobalFlags
0x4240a0 GetFileAttributesW
0x4240a4 SetTimeZoneInformation
0x4240a8 HeapQueryInformation
0x4240ac TerminateProcess
0x4240b0 GetTimeZoneInformation
0x4240b4 GetBinaryTypeW
0x4240b8 GetACP
0x4240bc lstrlenW
0x4240c0 SetThreadPriority
0x4240c4 CreateJobObjectA
0x4240c8 GetPrivateProfileIntW
0x4240cc FillConsoleOutputCharacterW
0x4240d0 GetLastError
0x4240d4 IsDBCSLeadByteEx
0x4240d8 SetLastError
0x4240dc GetProcAddress
0x4240e0 SetComputerNameA
0x4240e4 OpenWaitableTimerA
0x4240e8 LoadLibraryA
0x4240ec OpenThread
0x4240f0 OpenMutexA
0x4240f4 WriteConsoleA
0x4240f8 ProcessIdToSessionId
0x4240fc MoveFileA
0x424100 BuildCommDCBAndTimeoutsW
0x424104 WriteProfileSectionW
0x424108 AddAtomA
0x42410c SetCommMask
0x424110 SetSystemTime
0x424114 GetPrivateProfileSectionNamesA
0x424118 SetConsoleCursorInfo
0x42411c DebugSetProcessKillOnExit
0x424120 GetProcessShutdownParameters
0x424124 ContinueDebugEvent
0x424128 CancelTimerQueueTimer
0x42412c EnumResourceNamesA
0x424130 RequestWakeupLatency
0x424134 VirtualProtect
0x424138 GetConsoleCursorInfo
0x42413c OpenSemaphoreW
0x424140 ReleaseMutex
0x424144 FindAtomW
0x424148 AddConsoleAliasA
0x42414c DebugBreak
0x424150 ReadConsoleOutputCharacterW
0x424154 GetProfileSectionW
0x424158 GetVolumeInformationW
0x42415c CloseHandle
0x424160 CreateFileW
0x424164 InterlockedIncrement
0x424168 InterlockedDecrement
0x42416c InitializeCriticalSection
0x424170 DeleteCriticalSection
0x424174 EnterCriticalSection
0x424178 LeaveCriticalSection
0x42417c EncodePointer
0x424180 DecodePointer
0x424184 WideCharToMultiByte
0x424188 DeleteFileA
0x42418c GetCommandLineA
0x424190 HeapSetInformation
0x424194 GetStartupInfoW
0x424198 HeapValidate
0x42419c IsBadReadPtr
0x4241a0 RaiseException
0x4241a4 RtlUnwind
0x4241a8 IsProcessorFeaturePresent
0x4241ac GetCurrentProcess
0x4241b0 UnhandledExceptionFilter
0x4241b4 IsDebuggerPresent
0x4241b8 GetModuleFileNameW
0x4241bc GetOEMCP
0x4241c0 GetCPInfo
0x4241c4 IsValidCodePage
0x4241c8 TlsAlloc
0x4241cc TlsSetValue
0x4241d0 GetCurrentThreadId
0x4241d4 TlsFree
0x4241d8 GetModuleHandleW
0x4241dc InitializeCriticalSectionAndSpinCount
0x4241e0 SetStdHandle
0x4241e4 GetFileType
0x4241e8 WriteFile
0x4241ec GetConsoleCP
0x4241f0 ExitProcess
0x4241f4 QueryPerformanceCounter
0x4241f8 GetCurrentProcessId
0x4241fc GetSystemTimeAsFileTime
0x424200 GetModuleFileNameA
0x424204 FreeEnvironmentStringsW
0x424208 GetEnvironmentStringsW
0x42420c SetHandleCount
0x424210 GetStdHandle
0x424214 HeapCreate
0x424218 HeapReAlloc
0x42421c HeapSize
0x424220 HeapFree
0x424224 GetStringTypeW
0x424228 MultiByteToWideChar
0x42422c OutputDebugStringA
0x424230 WriteConsoleW
0x424234 OutputDebugStringW
0x424238 LoadLibraryW
0x42423c LCMapStringW
0x424240 SetFilePointer
0x424244 FlushFileBuffers
USER32.dll
0x42424c GetAncestor
0x424250 GetCursorInfo
EAT(Export Address Table) Library
0x422890 _CallPattern@8
KERNEL32.dll
0x424000 GetCommandLineW
0x424004 SetVolumeLabelA
0x424008 GetFileSize
0x42400c SetPriorityClass
0x424010 OpenFile
0x424014 WritePrivateProfileStructA
0x424018 CopyFileExW
0x42401c TlsGetValue
0x424020 GetDriveTypeW
0x424024 SetEndOfFile
0x424028 FindResourceExW
0x42402c LoadResource
0x424030 HeapAlloc
0x424034 SetUnhandledExceptionFilter
0x424038 SystemTimeToFileTime
0x42403c GetCommState
0x424040 ZombifyActCtx
0x424044 ScrollConsoleScreenBufferW
0x424048 WritePrivateProfileSectionA
0x42404c GetProfileStringW
0x424050 GetProfileSectionA
0x424054 WaitForSingleObject
0x424058 WriteConsoleInputA
0x42405c SetComputerNameW
0x424060 SetVolumeMountPointW
0x424064 FindFirstFileExW
0x424068 GetProcessPriorityBoost
0x42406c GetTickCount
0x424070 GetConsoleAliasesLengthA
0x424074 GetWindowsDirectoryA
0x424078 EnumTimeFormatsA
0x42407c GetSystemWow64DirectoryA
0x424080 SetProcessPriorityBoost
0x424084 GlobalAlloc
0x424088 GetConsoleMode
0x42408c TerminateThread
0x424090 GetPrivateProfileStructW
0x424094 GetSystemPowerStatus
0x424098 SetVolumeMountPointA
0x42409c GlobalFlags
0x4240a0 GetFileAttributesW
0x4240a4 SetTimeZoneInformation
0x4240a8 HeapQueryInformation
0x4240ac TerminateProcess
0x4240b0 GetTimeZoneInformation
0x4240b4 GetBinaryTypeW
0x4240b8 GetACP
0x4240bc lstrlenW
0x4240c0 SetThreadPriority
0x4240c4 CreateJobObjectA
0x4240c8 GetPrivateProfileIntW
0x4240cc FillConsoleOutputCharacterW
0x4240d0 GetLastError
0x4240d4 IsDBCSLeadByteEx
0x4240d8 SetLastError
0x4240dc GetProcAddress
0x4240e0 SetComputerNameA
0x4240e4 OpenWaitableTimerA
0x4240e8 LoadLibraryA
0x4240ec OpenThread
0x4240f0 OpenMutexA
0x4240f4 WriteConsoleA
0x4240f8 ProcessIdToSessionId
0x4240fc MoveFileA
0x424100 BuildCommDCBAndTimeoutsW
0x424104 WriteProfileSectionW
0x424108 AddAtomA
0x42410c SetCommMask
0x424110 SetSystemTime
0x424114 GetPrivateProfileSectionNamesA
0x424118 SetConsoleCursorInfo
0x42411c DebugSetProcessKillOnExit
0x424120 GetProcessShutdownParameters
0x424124 ContinueDebugEvent
0x424128 CancelTimerQueueTimer
0x42412c EnumResourceNamesA
0x424130 RequestWakeupLatency
0x424134 VirtualProtect
0x424138 GetConsoleCursorInfo
0x42413c OpenSemaphoreW
0x424140 ReleaseMutex
0x424144 FindAtomW
0x424148 AddConsoleAliasA
0x42414c DebugBreak
0x424150 ReadConsoleOutputCharacterW
0x424154 GetProfileSectionW
0x424158 GetVolumeInformationW
0x42415c CloseHandle
0x424160 CreateFileW
0x424164 InterlockedIncrement
0x424168 InterlockedDecrement
0x42416c InitializeCriticalSection
0x424170 DeleteCriticalSection
0x424174 EnterCriticalSection
0x424178 LeaveCriticalSection
0x42417c EncodePointer
0x424180 DecodePointer
0x424184 WideCharToMultiByte
0x424188 DeleteFileA
0x42418c GetCommandLineA
0x424190 HeapSetInformation
0x424194 GetStartupInfoW
0x424198 HeapValidate
0x42419c IsBadReadPtr
0x4241a0 RaiseException
0x4241a4 RtlUnwind
0x4241a8 IsProcessorFeaturePresent
0x4241ac GetCurrentProcess
0x4241b0 UnhandledExceptionFilter
0x4241b4 IsDebuggerPresent
0x4241b8 GetModuleFileNameW
0x4241bc GetOEMCP
0x4241c0 GetCPInfo
0x4241c4 IsValidCodePage
0x4241c8 TlsAlloc
0x4241cc TlsSetValue
0x4241d0 GetCurrentThreadId
0x4241d4 TlsFree
0x4241d8 GetModuleHandleW
0x4241dc InitializeCriticalSectionAndSpinCount
0x4241e0 SetStdHandle
0x4241e4 GetFileType
0x4241e8 WriteFile
0x4241ec GetConsoleCP
0x4241f0 ExitProcess
0x4241f4 QueryPerformanceCounter
0x4241f8 GetCurrentProcessId
0x4241fc GetSystemTimeAsFileTime
0x424200 GetModuleFileNameA
0x424204 FreeEnvironmentStringsW
0x424208 GetEnvironmentStringsW
0x42420c SetHandleCount
0x424210 GetStdHandle
0x424214 HeapCreate
0x424218 HeapReAlloc
0x42421c HeapSize
0x424220 HeapFree
0x424224 GetStringTypeW
0x424228 MultiByteToWideChar
0x42422c OutputDebugStringA
0x424230 WriteConsoleW
0x424234 OutputDebugStringW
0x424238 LoadLibraryW
0x42423c LCMapStringW
0x424240 SetFilePointer
0x424244 FlushFileBuffers
USER32.dll
0x42424c GetAncestor
0x424250 GetCursorInfo
EAT(Export Address Table) Library
0x422890 _CallPattern@8