popup

Report - askinstall52.exe

Gen2 Trojan_PWS_Stealer Credential User Data Malicious Packer UPX Malicious Library SQLite Cookie PE File OS Processor Check PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.08.16 17:21 Machine s1_win7_x6402
Filename askinstall52.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
1
 Behavior Score
6.4
ZERO API file : malware
VT API (file) 51 detected (AIDetect, malware2, malicious, high confidence, Zusy, DisbukRI, S19305183, GenericRXLT, Save, ZexaF, y10@aaLmawcj, Socelars, Eldorado, Attribute, HighConfidence, Razy, SpySocelars, PWSX, Gencirc, BGVO, Siggen13, Static AI, Suspicious PE, Disbuk, AGEN, ai score=82, ASMalwS, score, R372531, BScope, Agentb, Glupteba, Bruteforce, FBAdsCard, CLASSIC, A6ePo, susgen, Genetic, confidence, QVM20)
md5 ed8353cf1e80cb6afd65dedd1f83071a
sha256 c8d28298cf83e95158d8eb811ca0251af61a866d3eb55447ce092dc7c79c0952
ssdeep 24576:PIVFA1pqtg/TnMbX0lwyh0FVmEByA1EwFYyOsFTceoCSPZVjQMYfsowP:eFA1pvTMbOwa0TmUyMYEh1oCSPnQMYEB
imphash 4f0608b5638c60342069764638589dcf
impfuzzy 48:/XV+FLa0DZuBGRMUS0LES9wYQJcGtp48+9faOwOe6mxvmYBOvyzy:/XAFuEjRMr0LESBQJcGtp43ta736mxOP
  Network IP location

Signature (17cnts)

Level Description
danger File has been identified by 51 AntiVirus engines on VirusTotal as malicious
notice A process created a hidden window
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Creates a suspicious process
notice Creates executable files on the filesystem
notice Executes one or more WMI queries
notice Foreign language identified in PE resource
notice Performs some HTTP requests
notice Queries for potentially installed applications
notice Steals private information from local Internet browsers
notice Uses Windows utilities for basic Windows functionality
info Command line console output was observed
info Queries for the computername
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path
info Tries to locate where the browsers are installed

Rules (11cnts)

Level Name Description Collection
danger Trojan_PWS_Stealer_1_Zero Trojan.PWS.Stealer Zero binaries (upload)
warning Credential_User_Data_Check_Zero Credential User Data Check binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (download)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
watch SQLite_cookies_Check_Zero SQLite Cookie Check... select binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)
info Win32_Trojan_Gen_2_0904B0_Zero Win32 Trojan Gen binaries (upload)

Network (6cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
https://iplogger.org/1G7Sc7
whois
DE Hetzner Online GmbH 88.99.66.31 clean
https://www.listincode.com/
whois
US AS-CHOOPA 144.202.76.47 2327 mailcious
www.listincode.com
whois
US AS-CHOOPA 144.202.76.47 mailcious
iplogger.org
whois
DE Hetzner Online GmbH 88.99.66.31 mailcious
88.99.66.31
whois
DE Hetzner Online GmbH 88.99.66.31 mailcious
144.202.76.47
whois
US AS-CHOOPA 144.202.76.47 mailcious

Suricata ids

SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x50e050 LocalAlloc
 0x50e054 LocalFree
 0x50e058 WinExec
 0x50e05c GetComputerNameW
 0x50e060 GetModuleFileNameA
 0x50e064 GetCurrentProcessId
 0x50e068 OpenProcess
 0x50e06c GetModuleFileNameW
 0x50e070 SetLastError
 0x50e074 GetCurrentThread
 0x50e078 FindResourceW
 0x50e07c GetPrivateProfileStringW
 0x50e080 CopyFileW
 0x50e084 SetStdHandle
 0x50e088 SetEnvironmentVariableW
 0x50e08c FreeEnvironmentStringsW
 0x50e090 GetEnvironmentStringsW
 0x50e094 GetOEMCP
 0x50e098 SizeofResource
 0x50e09c CreateProcessA
 0x50e0a0 LockResource
 0x50e0a4 LoadResource
 0x50e0a8 FreeLibrary
 0x50e0ac GetTickCount
 0x50e0b0 TerminateProcess
 0x50e0b4 Sleep
 0x50e0b8 WaitForSingleObject
 0x50e0bc GetProcessHeap
 0x50e0c0 HeapAlloc
 0x50e0c4 GetLastError
 0x50e0c8 GetTempPathA
 0x50e0cc CreateDirectoryA
 0x50e0d0 SetCurrentDirectoryW
 0x50e0d4 GetShortPathNameA
 0x50e0d8 LoadLibraryW
 0x50e0dc GetProcAddress
 0x50e0e0 WideCharToMultiByte
 0x50e0e4 MultiByteToWideChar
 0x50e0e8 SystemTimeToFileTime
 0x50e0ec DosDateTimeToFileTime
 0x50e0f0 GetCurrentProcess
 0x50e0f4 DuplicateHandle
 0x50e0f8 CloseHandle
 0x50e0fc WriteFile
 0x50e100 SetFileTime
 0x50e104 SetFilePointer
 0x50e108 ReadFile
 0x50e10c GetFileType
 0x50e110 CreateFileW
 0x50e114 CreateDirectoryW
 0x50e118 CreateEventW
 0x50e11c GetCurrentDirectoryW
 0x50e120 GetACP
 0x50e124 IsValidCodePage
 0x50e128 FindNextFileW
 0x50e12c FindFirstFileExW
 0x50e130 FindClose
 0x50e134 GetTimeZoneInformation
 0x50e138 GetFileSizeEx
 0x50e13c GetConsoleCP
 0x50e140 SetFilePointerEx
 0x50e144 ReadConsoleW
 0x50e148 GetConsoleMode
 0x50e14c EnumSystemLocalesW
 0x50e150 GetUserDefaultLCID
 0x50e154 IsValidLocale
 0x50e158 GetCommandLineW
 0x50e15c GetCommandLineA
 0x50e160 GetStdHandle
 0x50e164 ExitProcess
 0x50e168 GetModuleHandleExW
 0x50e16c FreeLibraryAndExitThread
 0x50e170 ExitThread
 0x50e174 CreateThread
 0x50e178 LoadLibraryExW
 0x50e17c RtlUnwind
 0x50e180 RaiseException
 0x50e184 GetStringTypeW
 0x50e188 GetLocaleInfoW
 0x50e18c LCMapStringW
 0x50e190 CompareStringW
 0x50e194 GetCPInfo
 0x50e198 TlsFree
 0x50e19c WriteConsoleW
 0x50e1a0 TlsSetValue
 0x50e1a4 TlsGetValue
 0x50e1a8 TlsAlloc
 0x50e1ac SwitchToThread
 0x50e1b0 DecodePointer
 0x50e1b4 EncodePointer
 0x50e1b8 InitializeSListHead
 0x50e1bc GetStartupInfoW
 0x50e1c0 IsDebuggerPresent
 0x50e1c4 GetModuleHandleW
 0x50e1c8 ResetEvent
 0x50e1cc SetEvent
 0x50e1d0 InitializeCriticalSectionAndSpinCount
 0x50e1d4 IsProcessorFeaturePresent
 0x50e1d8 SetUnhandledExceptionFilter
 0x50e1dc UnhandledExceptionFilter
 0x50e1e0 FlushFileBuffers
 0x50e1e4 QueryPerformanceCounter
 0x50e1e8 MapViewOfFile
 0x50e1ec CreateFileMappingW
 0x50e1f0 FormatMessageA
 0x50e1f4 GetSystemTime
 0x50e1f8 GetSystemTimeAsFileTime
 0x50e1fc AreFileApisANSI
 0x50e200 TryEnterCriticalSection
 0x50e204 HeapCreate
 0x50e208 HeapFree
 0x50e20c EnterCriticalSection
 0x50e210 GetFullPathNameW
 0x50e214 GetDiskFreeSpaceW
 0x50e218 OutputDebugStringA
 0x50e21c LockFile
 0x50e220 LeaveCriticalSection
 0x50e224 InitializeCriticalSection
 0x50e228 GetFullPathNameA
 0x50e22c SetEndOfFile
 0x50e230 UnlockFileEx
 0x50e234 GetTempPathW
 0x50e238 CreateMutexW
 0x50e23c GetFileAttributesW
 0x50e240 GetCurrentThreadId
 0x50e244 UnmapViewOfFile
 0x50e248 HeapValidate
 0x50e24c HeapSize
 0x50e250 FormatMessageW
 0x50e254 GetDiskFreeSpaceA
 0x50e258 GetFileAttributesA
 0x50e25c GetFileAttributesExW
 0x50e260 OutputDebugStringW
 0x50e264 FlushViewOfFile
 0x50e268 CreateFileA
 0x50e26c LoadLibraryA
 0x50e270 WaitForSingleObjectEx
 0x50e274 DeleteFileA
 0x50e278 DeleteFileW
 0x50e27c HeapReAlloc
 0x50e280 GetSystemInfo
 0x50e284 HeapCompact
 0x50e288 HeapDestroy
 0x50e28c UnlockFile
 0x50e290 LockFileEx
 0x50e294 GetFileSize
 0x50e298 DeleteCriticalSection
ADVAPI32.dll
 0x50e000 LookupPrivilegeValueW
 0x50e004 AdjustTokenPrivileges
 0x50e008 LookupAccountNameW
 0x50e00c SetSecurityDescriptorOwner
 0x50e010 SetSecurityDescriptorGroup
 0x50e014 SetSecurityDescriptorDacl
 0x50e018 IsValidSecurityDescriptor
 0x50e01c InitializeSecurityDescriptor
 0x50e020 InitializeAcl
 0x50e024 GetTokenInformation
 0x50e028 GetLengthSid
 0x50e02c FreeSid
 0x50e030 EqualSid
 0x50e034 DuplicateToken
 0x50e038 AllocateAndInitializeSid
 0x50e03c AddAccessAllowedAce
 0x50e040 AccessCheck
 0x50e044 OpenThreadToken
 0x50e048 OpenProcessToken
SHELL32.dll
 0x50e2a8 ShellExecuteExA
ole32.dll
 0x50e2fc CoInitializeEx
 0x50e300 CoGetObject
 0x50e304 CoUninitialize
WININET.dll
 0x50e2b0 InternetGetCookieExA
NETAPI32.dll
 0x50e2a0 Netbios
ntdll.dll
 0x50e2b8 RtlInitUnicodeString
 0x50e2bc NtFreeVirtualMemory
 0x50e2c0 LdrEnumerateLoadedModules
 0x50e2c4 RtlEqualUnicodeString
 0x50e2c8 RtlAcquirePebLock
 0x50e2cc NtAllocateVirtualMemory
 0x50e2d0 RtlReleasePebLock
 0x50e2d4 RtlNtStatusToDosError
 0x50e2d8 RtlCreateHeap
 0x50e2dc RtlDestroyHeap
 0x50e2e0 RtlAllocateHeap
 0x50e2e4 RtlFreeHeap
 0x50e2e8 NtClose
 0x50e2ec NtOpenKey
 0x50e2f0 NtEnumerateValueKey
 0x50e2f4 NtQueryValueKey

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure