Report - vbc.exe

RAT Generic Malware Admin Tool (Sysinternals etc ...) PE File .NET EXE PE32

ScreenShot

Info
Location map


Created	2021.08.17 13:36	Machine	s1_win7_x6401
Filename	vbc.exe
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
AI Score	6	Behavior Score	3.0
ZERO API	file : malware
VT API (file)	30 detected (malicious, high confidence, GenericKD, AgentTesla, FDBQ, Unsafe, Save, Kryptik, ZemsilF, Im0@ai7Z9yh, Eldorado, Attribute, HighConfidence, ACFG, GenericML, xnet, FileRepMalware, Static AI, Malicious PE, ai score=99, Sabsik, score, R002H0CHG21, Outbreak, susgen, confidence)
md5	8396573aa3039b144f584107f785b321
sha256	5bd40d41fd5ace461e2eca366a13b63de2c75f2985be39de90f27fdbc6227d25
ssdeep	6144:92UsH9bygF8j57Ptttb+j2S8BU97My+sJhgRNMeryCVdKrL6dP:92s7jFHtHsAHsJivMeryCi/w
imphash	f34d5f2d4577ed6d9ceec516c1f5a744
impfuzzy	3:rGsLdAIEK:tf

Network IP location

Signature (7cnts)

Level	Description
danger	File has been identified by 30 AntiVirus engines on VirusTotal as malicious
watch	Communicates with host for which no DNS query was performed
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	The binary likely contains encrypted or compressed data indicative of a packer
info	Checks amount of memory in system
info	Checks if process is being debugged by a debugger
info	This executable has a PDB path

Rules (6cnts)

Level	Name	Description	Collection
warning	Generic_Malware_Zero	Generic Malware	binaries (upload)
watch	Admin_Tool_IN_Zero	Admin Tool Sysinternals	binaries (upload)
info	Is_DotNET_EXE	(no description)	binaries (upload)
info	IsPE32	(no description)	binaries (upload)
info	PE_Header_Zero	PE File Signature	binaries (upload)
info	Win_Backdoor_AsyncRAT_Zero	Win Backdoor AsyncRAT	binaries (upload)

Network (3cnts) ?

Request	CC	ASN Co	IP4	Rule ?	ZERO ?
105.27.205.34 whois		SEACOM-AS	105.27.205.34		mailcious
60.51.47.65 whois		TM Net, Internet Service Provider	60.51.47.65		mailcious
36.66.188.251 whois		PT Telekomunikasi Indonesia	36.66.188.251		clean

Suricata ids

PE API

IAT(Import Address Table) Library

mscoree.dll
0x402000 _CorExeMain

EAT(Export Address Table) is none

Similarity measure (PE file only) - Checking for service failure