Report - vbc.exe

RAT Generic Malware PE File PE32 .NET EXE

ScreenShot

Info
Location map


Created	2021.11.17 07:59	Machine	s1_win7_x6401
Filename	vbc.exe
Type	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
AI Score	1	Behavior Score	4.4
ZERO API	file : clean
VT API (file)	26 detected (Agensla, malicious, high confidence, MSILZilla, Artemis, TrojanPSW, Eldorado, Attribute, HighConfidence, FileRepMalware, qqpass, Qqrob, Static AI, Suspicious PE, PSWTroj, kcloud, ai score=82, PossibleThreat, GdSda, confidence)
md5	0e2cb83d70db215f56ee6af75325c661
sha256	3f574f37867464c83ca7aa9b71842704981c867b079f34394dba6abc5899ad66
ssdeep	96:TxzG8FKICRO0uUvQPclmYxiNQrnTlGNzRHa9LzNt:Tx5FKZRO0DvwVYcNQzTlGnHa9N
imphash	f34d5f2d4577ed6d9ceec516c1f5a744
impfuzzy	3:rGsLdAIEK:tf

Network IP location

Signature (12cnts)

Level	Description
warning	File has been identified by 26 AntiVirus engines on VirusTotal as malicious
watch	Communicates with host for which no DNS query was performed
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	Checks adapter addresses which can be used to detect virtual network interfaces
notice	Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice	HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice	Performs some HTTP requests
info	Checks amount of memory in system
info	Checks if process is being debugged by a debugger
info	Command line console output was observed
info	Queries for the computername
info	This executable has a PDB path

Rules (5cnts)

Level	Name	Description	Collection
warning	Generic_Malware_Zero	Generic Malware	binaries (upload)
info	Is_DotNET_EXE	(no description)	binaries (upload)
info	IsPE32	(no description)	binaries (upload)
info	PE_Header_Zero	PE File Signature	binaries (upload)
info	Win_Backdoor_AsyncRAT_Zero	Win Backdoor AsyncRAT	binaries (upload)

Network (2cnts) ?

Request	CC	ASN Co	IP4	Rule ?	ZERO ?
http://111.90.149.196/ALINK.txt whois		Shinjiru Technology Sdn Bhd	111.90.149.196		clean
111.90.149.196 whois		Shinjiru Technology Sdn Bhd	111.90.149.196		clean

Suricata ids

PE API

IAT(Import Address Table) Library

mscoree.dll
0x402000 _CorExeMain

EAT(Export Address Table) is none

Similarity measure (PE file only) - Checking for service failure