popup

Report - Pass1234_file.7z

Vidar Escalate priviledges PWS KeyLogger AntiDebug AntiVM
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.08.09 14:24 Machine s1_win7_x6402
Filename Pass1234_file.7z
Type 7-zip archive data, version 0.4
AI Score Not founds Behavior Score
6.6
ZERO API
VT API (file)
md5 8c849c3860d4cde88ae04546492f17dc
sha256 e25da9c7ffa4dbf78f611136ef2845e184e22590e299fd812948b8e3e6b18c77
ssdeep 98304:DZsZ9oVA+N0pt4sJvirJCwtZUNrR+G5JHq4eDeq/u+Of5Hof6rD:1DP4akEowtZUJHqN/u+w5O6X
imphash
impfuzzy
  Network IP location

Signature (14cnts)

Level Description
danger Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually)
watch Communicates with host for which no DNS query was performed
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Communication to multiple IPs on high port numbers possibly indicative of a peer-to-peer (P2P) or non-standard command and control protocol
notice Creates executable files on the filesystem
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice Looks up the external IP address
notice Performs some HTTP requests
notice Resolves a suspicious Top Level Domain (TLD)
notice Sends data using the HTTP POST Method
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger

Rules (11cnts)

Level Name Description Collection
notice Escalate_priviledges Escalate priviledges memory
notice Generic_PWS_Memory_Zero PWS Memory memory
notice KeyLogger Run a KeyLogger memory
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (96cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://94.142.138.131/api/firegate.php
whois
RU Ihor Hosting LLC 94.142.138.131 32650
http://193.233.254.61/loghub/master
whois
RU OOO FREEnet Group 193.233.254.61 35736
http://hugersi.com/dl/6523.exe
whois
RU Petersburg Internet Network ltd. 91.215.85.147 32660
http://zzz.fhauiehgha.com/m/okka25.exe
whois
US HK Kwaifong Group Limited 156.236.72.121 34705
http://aa.imgjeoogbb.com/check/safe
whois
HK HK Kwaifong Group Limited 154.221.26.108 34652
http://65.21.187.146/
whois
Unknown 65.21.187.146
http://45.15.156.229/api/tracemap.php
whois
RU CJSC Kolomna-Sviaz TV 45.15.156.229 33783
http://aa.imgjeoogbb.com/check/?sid=294936&key=d9eb18658941edfb01ef7f4e4f3bcf60
whois
HK HK Kwaifong Group Limited 154.221.26.108 34651
http://95.214.25.207:3002/file.exe
whois
DE CMCS 95.214.25.207 35494
http://77.91.68.61/rock/index.php
whois
RU Foton Telecom CJSC 77.91.68.61 35495
http://65.21.187.146/43a6ce95ca0edbaf09babc2b3d43fe58
whois
Unknown 65.21.187.146
http://87.121.221.58/g.exe
whois
Unknown 87.121.221.58
http://apps.identrust.com/roots/dstrootcax3.p7c
whois
US Akamai International B.V. 23.67.53.17
http://94.142.138.131/api/tracemap.php
whois
RU Ihor Hosting LLC 94.142.138.131 28311
http://www.maxmind.com/geoip/v2.1/city/me
whois
US CLOUDFLARENET 104.17.215.67
http://208.67.104.60/api/tracemap.php
whois
Unknown 208.67.104.60 28876
http://us.imgjeoigaa.com/sts/imagc.jpg
whois
HK HK Kwaifong Group Limited 103.100.211.218 33482
http://65.21.187.146/files.zip
whois
Unknown 65.21.187.146
http://77.91.124.231/info/photo443.exe
whois
RU Foton Telecom CJSC 77.91.124.231 35604
http://176.113.115.84:8080/4.php
whois
RU OOO Network of data-centers Selectel 176.113.115.84 34795
https://busell.store/setup294.exe
whois
US CLOUDFLARENET 104.21.9.89
https://vk.com/doc801981293_667406864?hash=uZtMvR4ZNW8WKezoz5XxQw5zKDEIBGP5eVquLMZQIhs&dl=LPW7PFXZtcJLownI3eqGgO4ACOVJ8g7SlBJbPXo7NZX&api=1&no_preview=1#WW1
whois
RU VKontakte Ltd 87.240.132.78
https://vk.com/doc791620691_663065029?hash=Efubo9FQtw3Bdj42XJVcJwymfIH3PazMKz8g5wJ0dZX&dl=G44TCNRSGA3DSMI:1682787066:QgrgzF33wDt9bwmmOgWCYTv61J7HwhLVZOXGaEdWiKP&api=1&no_preview=1#test
whois
RU VKontakte Ltd 87.240.132.78
https://sun6-23.userapi.com/c909228/u801981293/docs/d20/1c1fbf1bf284/fse.bmp?extra=4_jy8uhFMEaLDwCkNxpWmgh94F8cfoFaPIan-8Dtq-90eX9YgxglCma4ibrxupgDp67zjlLLmn3oM4vn_4Lcy60SuF-xbd7WtSmxPbbqXF5I2f8XPvKEFgk5TjKmCaLP5EtabfY2xp2fEb_GZg
whois
RU VKontakte Ltd 95.142.206.3
https://vk.com/doc801981293_667454987?hash=kPpi9bC3rv9q7iZDCWdCIDMK6XFt1NWknu5RxXyxZST&dl=slQ3yZBhbXAyX5QrjOWy1faytAkizWc5WCVP1enGF7H&api=1&no_preview=1
whois
RU VKontakte Ltd 87.240.132.78
https://steamcommunity.com/profiles/76561199532186526
whois
US Akamai International B.V. 104.76.78.101 35698
https://sun6-21.userapi.com/c909618/u801981293/docs/d37/81a43648135e/WWW1.bmp?extra=t4h0dCojdHQ9CBRhBgSlMwlX__2pm62d9iqHWHxa4yaqyWbHETFz2CtZPAv8kaHxOrxQorbDrTi3sk1G5eP5MeAcS7R5Es1b2jwTgIL0nLizkKZJ7JW0MBNFmsH1raDTFmJzxnIIH3MnZK-iGw
whois
RU VKontakte Ltd 95.142.206.1
https://api.db-ip.com/v2/p31e4d59ee6ad1a0b5cc80695a873e43a8fbca06/self
whois
US CLOUDFLARENET 104.26.4.15
https://sun6-23.userapi.com/c240331/u801981293/docs/d56/dab33f053e7c/PMmp.bmp?extra=a4Cg8XIbUtZZBJyBQCMW4u__V4MU2I7W7NYiQS3KlkgLS1hFGI4dFSeDqItPwxD9iGpDcky1Bw9Ddc2BJudwVjTqCJRs2To8Eqgtk_3_Zl4z_IY4-X2B8ePuzB7q8vf2ACOz8efgpXGK-A6v_Q
whois
RU VKontakte Ltd 95.142.206.3
https://vk.com/doc746114504_647280747?hash=cvDFKP5q0CQEjBCbeoeHvPNrWE0xbMxZEmrkIeNKcET&dl=G42DMMJRGQ2TANA:1661413520:uZNj68vRUvQaydRD8wpAK8zluN0I7otw5AHbA1ZlN9T&api=1&no_preview=1
whois
RU VKontakte Ltd 87.240.132.78
https://vk.com/doc801981293_667486594?hash=imfz8iVrsd0ACccnF0GZIUltD8XX5X3arwn4kxjKrGH&dl=7kNZPXNmlDfZM6XyNQJ0E5zKssx8LEYlz2E1h2FUgZk&api=1&no_preview=1#fse
whois
RU VKontakte Ltd 87.240.132.78
https://sun6-20.userapi.com/c240331/u801981293/docs/d8/1f5ae35150b7/siddharthabuddh4_2.bmp?extra=B7BtTuv_7jmb8cCMaLam49APjJzrtiYZZzp3rziQku1r1BN59h4GUS5Dlv0sdMxlHC6wmC-J3k578d7Nsnx7pBDX6Oy74RUAIQXIuc0nfUwip49td2R-6P-iXhn7AazYaV5F2sSahyy5VRY36g
whois
RU VKontakte Ltd 95.142.206.0
https://sun6-21.userapi.com/c909418/u801981293/docs/d20/1e2b07ec3a9d/test.bmp?extra=qMq_Hfaqw0yUQD5zYrK1RBqcLLfE3A2AU0FdG85zayvGWJs2ZFqVwwlittGHO2AiyIVbBEjb9ZK5L_1e_9_nKp7YReGxGKr0knhKpVpMJqu_rfIHNIML5L_f8elMCrbXg40EAQk9_-mEr-B2bw
whois
RU VKontakte Ltd 95.142.206.1
https://db-ip.com/
whois
US CLOUDFLARENET 172.67.75.166
https://vk.com/doc791620691_663065029?hash=Efubo9FQtw3Bdj42XJVcJwymfIH3PazMKz8g5wJ0dZX&dl=G44TCNRSGA3DSMI:1682787066:QgrgzF33wDt9bwmmOgWCYTv61J7HwhLVZOXGaEdWiKP&api=1&no_preview=1#stats
whois
RU VKontakte Ltd 87.240.132.78
https://vk.com/doc801981293_667588255?hash=D2CJ0xHL4AttqOVEQrcszbzjAqHflz5sitrNnCDwHML&dl=1MkLYb1Zn2lmLZ7wS6mD5tteEUeivr15Bnn3xZoovqk&api=1&no_preview=1
whois
RU VKontakte Ltd 87.240.132.78
https://vk.com/doc801981293_667539838?hash=1wYO1Ous0beVWiHJAejgZ3eSHSzodvDxJWbbkFPgBQs&dl=SQxo7vjhnlb1LQCUeoVijfnKU0E3auPCNV18GmDNZC0&api=1&no_preview=1#test
whois
RU VKontakte Ltd 87.240.132.78
t.me
whois
GB Telegram Messenger Inc 149.154.167.99 mailcious
sun6-23.userapi.com
whois
RU VKontakte Ltd 95.142.206.3 clean
api.db-ip.com
whois
US CLOUDFLARENET 104.26.4.15 clean
api.myip.com
whois
US CLOUDFLARENET 104.26.8.59 clean
hugersi.com
whois
RU Petersburg Internet Network ltd. 91.215.85.147 malware
steamcommunity.com
whois
US Akamai International B.V. 104.76.78.101 mailcious
db-ip.com
whois
US CLOUDFLARENET 104.26.5.15 clean
busell.store
whois
US CLOUDFLARENET 172.67.159.178 clean
www.maxmind.com
whois
US CLOUDFLARENET 104.17.214.67 clean
zzz.fhauiehgha.com
whois
US HK Kwaifong Group Limited 156.236.72.121 mailcious
iplogger.org
whois
DE Hetzner Online GmbH 148.251.234.83 mailcious
ipinfo.io
whois
US GOOGLE 34.117.59.81 clean
aa.imgjeoogbb.com
whois
HK HK Kwaifong Group Limited 154.221.26.108 mailcious
us.imgjeoigaa.com
whois
HK HK Kwaifong Group Limited 103.100.211.218 mailcious
fastpool.xyz
whois
BG Vivacom 213.91.128.133 mailcious
sun6-20.userapi.com
whois
RU VKontakte Ltd 95.142.206.0 mailcious
vk.com
whois
RU VKontakte Ltd 93.186.225.194 mailcious
vanaheim.cn
whois
RU JSC Evrasia Telecom Ru 77.232.41.127 clean
sun6-21.userapi.com
whois
RU VKontakte Ltd 95.142.206.1 mailcious
iplis.ru
whois
DE Hetzner Online GmbH 148.251.234.93 mailcious
148.251.234.93
whois
DE Hetzner Online GmbH 148.251.234.93
154.221.26.108
whois
HK HK Kwaifong Group Limited 154.221.26.108 mailcious
87.121.221.58
whois
Unknown 87.121.221.58 malware
209.250.248.11
whois
NL AS-CHOOPA 209.250.248.11 clean
104.21.9.89
whois
US CLOUDFLARENET 104.21.9.89 clean
91.215.85.147
whois
RU Petersburg Internet Network ltd. 91.215.85.147 malware
65.21.187.146
whois
Unknown 65.21.187.146 clean
208.67.104.60
whois
Unknown 208.67.104.60 mailcious
95.214.25.207
whois
DE CMCS 95.214.25.207 malware
149.154.167.99
whois
GB Telegram Messenger Inc 149.154.167.99 mailcious
172.67.75.166
whois
US CLOUDFLARENET 172.67.75.166 clean
172.67.75.163
whois
US CLOUDFLARENET 172.67.75.163 clean
193.233.254.61
whois
RU OOO FREEnet Group 193.233.254.61 mailcious
194.26.135.162
whois
Unknown 194.26.135.162 mailcious
87.240.132.78
whois
RU VKontakte Ltd 87.240.132.78 mailcious
34.117.59.81
whois
US GOOGLE 34.117.59.81 clean
176.113.115.84
whois
RU OOO Network of data-centers Selectel 176.113.115.84 mailcious
148.251.234.83
whois
DE Hetzner Online GmbH 148.251.234.83 clean
77.232.41.127
whois
RU JSC Evrasia Telecom Ru 77.232.41.127 clean
45.15.156.229
whois
RU CJSC Kolomna-Sviaz TV 45.15.156.229 mailcious
94.142.138.131
whois
RU Ihor Hosting LLC 94.142.138.131 mailcious
176.123.9.142
whois
MD Alexhost Srl 176.123.9.142 mailcious
77.91.124.231
whois
RU Foton Telecom CJSC 77.91.124.231 malware
185.225.73.32
whois
DE Mayak Smart Services Ltd. 185.225.73.32 clean
104.17.214.67
whois
US CLOUDFLARENET 104.17.214.67 clean
77.91.68.61
whois
RU Foton Telecom CJSC 77.91.68.61 malware
156.236.72.121
whois
US HK Kwaifong Group Limited 156.236.72.121 mailcious
23.67.53.17
whois
US Akamai International B.V. 23.67.53.17 clean
104.26.4.15
whois
US CLOUDFLARENET 104.26.4.15 clean
95.142.206.3
whois
RU VKontakte Ltd 95.142.206.3 clean
163.123.143.4
whois
Unknown 163.123.143.4 mailcious
95.142.206.1
whois
RU VKontakte Ltd 95.142.206.1 mailcious
95.142.206.0
whois
RU VKontakte Ltd 95.142.206.0 mailcious
77.91.124.54
whois
RU Foton Telecom CJSC 77.91.124.54 clean
85.208.136.10
whois
DE CMCS 85.208.136.10 mailcious
62.122.184.58
whois
Unknown 62.122.184.58 clean
103.100.211.218
whois
HK HK Kwaifong Group Limited 103.100.211.218 malware
213.91.128.133
whois
BG Vivacom 213.91.128.133 mailcious
104.76.78.101
whois
US Akamai International B.V. 104.76.78.101 mailcious

Suricata ids


Similarity measure (PE file only) - Checking for service failure