popup

Report - pass1234_setup.7z

Escalate priviledges PWS KeyLogger AntiDebug AntiVM
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.08.17 16:01 Machine s1_win7_x6402
Filename pass1234_setup.7z
Type 7-zip archive data, version 0.4
AI Score Not founds Behavior Score
6.2
ZERO API file : malware
VT API (file)
md5 8155b0ec79e7e80cdab9b7fbdfac1a4c
sha256 2705b1a4187b9b8a96e51383543f308673db76ee39cb417fa67cf639d6c27594
ssdeep 98304:2J9uf43ddxJJpN6X8R/sAdMyiGKbMXCkBiIebydDignl8Y1t++U0Tb1BFjyNGqUI:2J9usdxJQsR/sASyipYC0jzdD8Y1t++k
imphash
impfuzzy
  Network IP location

Signature (13cnts)

Level Description
danger Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually)
watch Communicates with host for which no DNS query was performed
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Creates executable files on the filesystem
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice Looks up the external IP address
notice Performs some HTTP requests
notice Resolves a suspicious Top Level Domain (TLD)
notice Sends data using the HTTP POST Method
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger

Rules (11cnts)

Level Name Description Collection
notice Escalate_priviledges Escalate priviledges memory
notice Generic_PWS_Memory_Zero PWS Memory memory
notice KeyLogger Run a KeyLogger memory
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (65cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://94.142.138.131/api/firegate.php
whois
RU Ihor Hosting LLC 94.142.138.131 32650 mailcious
http://193.233.254.61/loghub/master
whois
RU OOO FREEnet Group 193.233.254.61 35736 mailcious
http://zzz.fhauiehgha.com/m/okka25.exe
whois
HK HK Kwaifong Group Limited 103.100.211.218 34705 mailcious
http://45.15.156.229/api/tracemap.php
whois
RU CJSC Kolomna-Sviaz TV 45.15.156.229 33783 mailcious
http://apps.identrust.com/roots/dstrootcax3.p7c
whois
US Akamai International B.V. 23.67.53.18 clean
http://94.142.138.131/api/tracemap.php
whois
RU Ihor Hosting LLC 94.142.138.131 28311 mailcious
http://www.maxmind.com/geoip/v2.1/city/me
whois
US CLOUDFLARENET 104.17.215.67 clean
http://77.91.124.231/info/photo551.exe
whois
RU Foton Telecom CJSC 77.91.124.231 35889 malware
http://194.169.175.233:3002/file.exe
whois
Unknown 194.169.175.233 35890 malware
https://busell.store/setup294.exe
whois
US CLOUDFLARENET 104.21.9.89 35772 malware
https://vk.com/doc647736509_665757351?hash=xRNMJvtBxeMy9F0ahVhVsVflJbZD3QhaFKB8SVYcH0D&dl=kYv4t3v9Ds2wZeYJd9j0pkiCfCSj0PVEWEjq6i56Xf0&api=1&no_preview=1
whois
RU VKontakte Ltd 87.240.132.78 clean
https://sun9-23.userapi.com/c909628/u647736509/docs/d6/2b03bce96a50/RisePro.bmp?extra=_gy9Fkc7ia4J1Y4oYNfs8Xa7wrsLFOGxt4OpQp8otyquVNDz4hADbtQtsCt1LZFzxYGMCCBgIFUNP94-Q7GaUH2Pr13mFrSm3KrQYFFsKlyok7wZHZ-2ou-7FIkAO62qCjGtmie1x6mRM3bQPw
whois
RU VKontakte Ltd 93.186.227.134 clean
https://vk.com/doc791620691_663065029?hash=Efubo9FQtw3Bdj42XJVcJwymfIH3PazMKz8g5wJ0dZX&dl=G44TCNRSGA3DSMI:1682787066:QgrgzF33wDt9bwmmOgWCYTv61J7HwhLVZOXGaEdWiKP&api=1&no_preview=1#test
whois
RU VKontakte Ltd 87.240.132.78 mailcious
https://sun9-37.userapi.com/c237231/u647736509/docs/d56/8e14ffa72cce/WWW1.bmp?extra=78GAMabH9oO1WBAySv7MDUhIItpKOCZbdOgIVDBAp41hmtogaewY2Dn2y1klnfsi_O4JX1dijipA4Bwa5yFfR2XuCyc5QF5-PuLYXAr-ea11gOlGW160iI4-PeBt5y-9oontYoqQn9G2Fufs-A
whois
RU VKontakte Ltd 87.240.185.144 clean
https://db-ip.com/demo/home.php?s=175.208.134.152
whois
US CLOUDFLARENET 104.26.5.15 clean
https://vk.com/doc647736509_665757320?hash=dfBBWeSNlNkIvHcK2uMdd2AbZmqfwD2ZZg0vYymBkR0&dl=gjNC6HkPkk10dAOYzHDYqNL4zQsWEaKk2Lm1A39kSP0&api=1&no_preview=1#rise
whois
RU VKontakte Ltd 87.240.132.78 clean
https://sun9-55.userapi.com/c909628/u647736509/docs/d12/f72ab395cffd/PMmp.bmp?extra=NEaDTBOuefQ2B8QBX6xUPwZDSW8bnMhC2aUgngVAf_uXwfYqQgy3B8_v1uRdw3nm9FHqWDJJZ51JLJy1p_oZt7BBOpIXerIGYSLZhb-2FhjtQWvhh_mhLCglL67FNraydwtM9x7XMIvrTNawvA
whois
RU VKontakte Ltd 87.240.185.158 clean
https://vk.com/doc801981293_667803773?hash=4TZb5YnWuA82PVbdDAhWZa2MZaLOxCkMyK03PTWXZ7k&dl=ybWpay00uXdDBpwpvEqOzXKaXInNaUyNw2LywEIZEV8&api=1&no_preview=1#new
whois
RU VKontakte Ltd 87.240.132.78 mailcious
https://db-ip.com/
whois
US CLOUDFLARENET 104.26.5.15 clean
https://vk.com/doc746114504_647280747?hash=cvDFKP5q0CQEjBCbeoeHvPNrWE0xbMxZEmrkIeNKcET&dl=G42DMMJRGQ2TANA:1661413520:uZNj68vRUvQaydRD8wpAK8zluN0I7otw5AHbA1ZlN9T&api=1&no_preview=1
whois
RU VKontakte Ltd 87.240.132.78 mailcious
https://api.db-ip.com/v2/p31e4d59ee6ad1a0b5cc80695a873e43a8fbca06/self
whois
US CLOUDFLARENET 104.26.5.15 clean
https://vk.com/doc647736509_665757334?hash=BLle7vdX3iFMB4azpVJZYs9WrN6tEhp1wsHXrbQ6Ufz&dl=vr8PySakhGw7js63wfoBEncgnNsFZVbFO8czAHxd9Bk&api=1&no_preview=1#WW1
whois
RU VKontakte Ltd 87.240.132.78 clean
https://vk.com/doc791620691_663065029?hash=Efubo9FQtw3Bdj42XJVcJwymfIH3PazMKz8g5wJ0dZX&dl=G44TCNRSGA3DSMI:1682787066:QgrgzF33wDt9bwmmOgWCYTv61J7HwhLVZOXGaEdWiKP&api=1&no_preview=1#stats
whois
RU VKontakte Ltd 87.240.132.78 mailcious
https://vk.com/doc801981293_667856853?hash=u4TwZPGmvpaLEXEgEofjgmISgf2DosuyvS7wFUA0tZk&dl=8pK0VUDG0zKxMEJJ6FyyCNKfZqf5zwCbcvZUj3dqtQs&api=1&no_preview=1
whois
RU VKontakte Ltd 87.240.132.78 mailcious
db-ip.com
whois
US CLOUDFLARENET 104.26.4.15 clean
z.nnnaajjjgc.com
whois
US HK Kwaifong Group Limited 156.236.72.121 malware
iplis.ru
whois
DE Hetzner Online GmbH 148.251.234.93 mailcious
sun9-23.userapi.com
whois
RU VKontakte Ltd 93.186.227.134 clean
sun9-37.userapi.com
whois
RU VKontakte Ltd 87.240.185.144 clean
busell.store
whois
US CLOUDFLARENET 172.67.159.178 malware
zzz.fhauiehgha.com
whois
HK HK Kwaifong Group Limited 103.100.211.218 mailcious
sun9-55.userapi.com
whois
RU VKontakte Ltd 87.240.185.158 clean
ipinfo.io
whois
US GOOGLE 34.117.59.81 clean
api.myip.com
whois
US CLOUDFLARENET 104.26.9.59 clean
bitbucket.org
whois
US ATLASSIAN PTY LTD 104.192.141.1 malware
www.maxmind.com
whois
US CLOUDFLARENET 104.17.215.67 clean
api.db-ip.com
whois
US CLOUDFLARENET 104.26.4.15 clean
iplogger.org
whois
DE Hetzner Online GmbH 148.251.234.83 mailcious
vk.com
whois
RU VKontakte Ltd 87.240.129.133 mailcious
148.251.234.93
whois
DE Hetzner Online GmbH 148.251.234.93 mailcious
194.169.175.128
whois
Unknown 194.169.175.128 mailcious
104.21.9.89
whois
US CLOUDFLARENET 104.21.9.89 malware
104.26.5.15
whois
US CLOUDFLARENET 104.26.5.15 clean
208.67.104.60
whois
Unknown 208.67.104.60 mailcious
87.240.185.158
whois
RU VKontakte Ltd 87.240.185.158 clean
87.121.221.58
whois
Unknown 87.121.221.58 malware
51.83.170.21
whois
FR OVH SAS 51.83.170.21 mailcious
193.233.254.61
whois
RU OOO FREEnet Group 193.233.254.61 mailcious
87.240.185.144
whois
RU VKontakte Ltd 87.240.185.144 clean
34.117.59.81
whois
US GOOGLE 34.117.59.81 clean
148.251.234.83
whois
DE Hetzner Online GmbH 148.251.234.83 clean
93.186.227.134
whois
RU VKontakte Ltd 93.186.227.134 clean
194.169.175.233
whois
Unknown 194.169.175.233 malware
94.142.138.131
whois
RU Ihor Hosting LLC 94.142.138.131 mailcious
104.192.141.1
whois
US ATLASSIAN PTY LTD 104.192.141.1 mailcious
77.91.124.231
whois
RU Foton Telecom CJSC 77.91.124.231 malware
104.17.214.67
whois
US CLOUDFLARENET 104.17.214.67 clean
156.236.72.121
whois
US HK Kwaifong Group Limited 156.236.72.121 mailcious
45.15.156.229
whois
RU CJSC Kolomna-Sviaz TV 45.15.156.229 mailcious
172.67.75.163
whois
US CLOUDFLARENET 172.67.75.163 clean
163.123.143.4
whois
Unknown 163.123.143.4 mailcious
77.91.124.54
whois
RU Foton Telecom CJSC 77.91.124.54 mailcious
121.254.136.27
whois
KR LG DACOM Corporation 121.254.136.27 clean
87.240.132.78
whois
RU VKontakte Ltd 87.240.132.78 mailcious
103.100.211.218
whois
HK HK Kwaifong Group Limited 103.100.211.218 malware

Suricata ids


Similarity measure (PE file only) - Checking for service failure