Report - swo.exe

RAT PWS .NET framework UPX PE32 OS Processor Check .NET EXE PE File
ScreenShot
Created 2023.02.12 15:01 Machine s1_win7_x6401
Filename swo.exe
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
AI Score
5
Behavior Score
4.2
ZERO API file : malware
VT API (file) 59 detected (AIDetectNet, GenericKD, GenericFC, S29514937, PasswordStealer, Redline, Visy, malicious, ZemsilF, km0@ay@EHun, PSWStealer, Kryptik, Eldorado, Whispergate, high confidence, score, jumraq, PWSX, AGEN, YXDA2Z, GenericRXQA, Reline, Static AI, Suspicious PE, aocbi, kcloud, Detected, ai score=87, CLASSIC, hUjUZpJbI8M, RedLineStealer, susgen, GdSda, confidence, 100%)
md5 a7836eb23a023808fedb12c080314dc7
sha256 bf5e49b09c2c5a21efb1b68d246fa57ecfd37f77e36b087f785f5079096f416e
ssdeep 3072:ExqZWWFa7E6T8WDbta4keK49rh+7xNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOF:aqZPWDbtxLrh
imphash f34d5f2d4577ed6d9ceec516c1f5a744
impfuzzy 3:rGsLdAIEK:tf
  Network IP location

Signature (7cnts)

Level Description
danger Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually)
danger File has been identified by 59 AntiVirus engines on VirusTotal as malicious
watch Communicates with host for which no DNS query was performed
notice Allocates read-write-execute memory (usually to unpack itself)
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Uses Windows APIs to generate a cryptographic key

Rules (7cnts)

Level Name Description Collection
watch UPX_Zero UPX packed file binaries (upload)
watch Win32_Trojan_PWS_Net_1_Zero Win32 Trojan PWS .NET Azorult binaries (upload)
info Is_DotNET_EXE (no description) binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)
info Win_Backdoor_AsyncRAT_Zero Win Backdoor AsyncRAT binaries (upload)

Network (3cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
49.12.247.184 DE Hetzner Online GmbH 49.12.247.184 clean
37.230.138.123 RU RocketTelecom LLC 37.230.138.123 mailcious
37.230.138.66 RU RocketTelecom LLC 37.230.138.66 mailcious

Suricata ids

PE API

IAT(Import Address Table) Library

mscoree.dll
 0x402000 _CorExeMain

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure