popup

Report - pass1234_setup.7z

Escalate priviledges PWS KeyLogger AntiDebug AntiVM
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.08.18 18:01 Machine s1_win7_x6402
Filename pass1234_setup.7z
Type 7-zip archive data, version 0.4
AI Score Not founds Behavior Score
6.2
ZERO API file : clean
VT API (file)
md5 cd129faa117216c35156304670140b06
sha256 2ed51b16a10c47ea4cfc865e789b9f0a5f99a5f36cca9c15a17106325a03d45c
ssdeep 98304:Y9jhqXahtjjA9ZUpP7ut9TLLfZFKA83tCQ4Cz83aVGGrzcfK1CMhWzXiDLjiK8e2:Y9NqXaLc9ZqatFPRFKA89N4T3KGffiSt
imphash
impfuzzy
  Network IP location

Signature (13cnts)

Level Description
danger Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually)
watch Communicates with host for which no DNS query was performed
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Communication to multiple IPs on high port numbers possibly indicative of a peer-to-peer (P2P) or non-standard command and control protocol
notice Creates executable files on the filesystem
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice Looks up the external IP address
notice Performs some HTTP requests
notice Sends data using the HTTP POST Method
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger

Rules (11cnts)

Level Name Description Collection
notice Escalate_priviledges Escalate priviledges memory
notice Generic_PWS_Memory_Zero PWS Memory memory
notice KeyLogger Run a KeyLogger memory
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (77cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://94.142.138.131/api/firegate.php
whois
RU Ihor Hosting LLC 94.142.138.131 32650 mailcious
http://208.67.104.60/api/tracemap.php
whois
Unknown 208.67.104.60 28876 mailcious
http://193.233.254.61/loghub/master
whois
RU OOO FREEnet Group 193.233.254.61 35736 mailcious
http://zzz.fhauiehgha.com/m/okka25.exe
whois
HK HK Kwaifong Group Limited 103.100.211.218 34705 mailcious
http://45.15.156.229/api/tracemap.php
whois
RU CJSC Kolomna-Sviaz TV 45.15.156.229 33783 mailcious
http://87.121.221.58/g.exe
whois
Unknown 87.121.221.58 35764 malware
http://apps.identrust.com/roots/dstrootcax3.p7c
whois
US Akamai International B.V. 23.67.53.18 clean
http://94.142.138.131/api/tracemap.php
whois
RU Ihor Hosting LLC 94.142.138.131 28311 mailcious
http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=GPe3xmuleVDaoOMEldmdr3MP.exe&platform=0009&osver=5&isServer=0
whois
US AKAMAI-AS 184.30.187.53 clean
http://77.91.124.231/info/photo551.exe
whois
RU Foton Telecom CJSC 77.91.124.231 35889 malware
http://194.169.175.233:3002/file.exe
whois
Unknown 194.169.175.233 35890 malware
http://www.maxmind.com/geoip/v2.1/city/me
whois
US CLOUDFLARENET 104.17.214.67 clean
https://busell.store/setup294.exe
whois
US CLOUDFLARENET 104.21.9.89 35772 malware
https://transfer.sh/get/S8wmOYi1yh/s28a1f.exe
whois
DE Hetzner Online GmbH 144.76.136.153 clean
https://vk.com/doc647736509_665757351?hash=xRNMJvtBxeMy9F0ahVhVsVflJbZD3QhaFKB8SVYcH0D&dl=kYv4t3v9Ds2wZeYJd9j0pkiCfCSj0PVEWEjq6i56Xf0&api=1&no_preview=1
whois
RU VKontakte Ltd 93.186.225.194 mailcious
https://transfer.sh/get/Els5w2XD23/1ds3y.exe
whois
DE Hetzner Online GmbH 144.76.136.153 clean
https://vk.com/doc791620691_663065029?hash=Efubo9FQtw3Bdj42XJVcJwymfIH3PazMKz8g5wJ0dZX&dl=G44TCNRSGA3DSMI:1682787066:QgrgzF33wDt9bwmmOgWCYTv61J7HwhLVZOXGaEdWiKP&api=1&no_preview=1#test
whois
RU VKontakte Ltd 93.186.225.194 mailcious
https://sun6-22.userapi.com/c237231/u647736509/docs/d56/ff6bde39d062/WWW1.bmp?extra=s__W1ni87TI6Duoswc_5WTp-ZIO2Qd59SKzhEqRFcQl-k1J4KAcBfVMo-bPsw0dFD9VXVx7H98KchsBhY5pJ34s_2Pecy9ZUMezwbbMr7285OlnifZTf678xl_FtoUV2KZ57GsxX98HPQN8_MQ
whois
RU VKontakte Ltd 95.142.206.2 clean
https://db-ip.com/demo/home.php?s=175.208.134.152
whois
US CLOUDFLARENET 172.67.75.166 clean
https://vk.com/doc647736509_665757320?hash=dfBBWeSNlNkIvHcK2uMdd2AbZmqfwD2ZZg0vYymBkR0&dl=gjNC6HkPkk10dAOYzHDYqNL4zQsWEaKk2Lm1A39kSP0&api=1&no_preview=1#rise
whois
RU VKontakte Ltd 93.186.225.194 mailcious
https://api.db-ip.com/v2/p31e4d59ee6ad1a0b5cc80695a873e43a8fbca06/self
whois
US CLOUDFLARENET 172.67.75.166 clean
https://db-ip.com/
whois
US CLOUDFLARENET 172.67.75.166 clean
https://vk.com/doc746114504_647280747?hash=cvDFKP5q0CQEjBCbeoeHvPNrWE0xbMxZEmrkIeNKcET&dl=G42DMMJRGQ2TANA:1661413520:uZNj68vRUvQaydRD8wpAK8zluN0I7otw5AHbA1ZlN9T&api=1&no_preview=1
whois
RU VKontakte Ltd 93.186.225.194 mailcious
https://sun6-21.userapi.com/c909628/u647736509/docs/d12/fd5c7be24aa4/PMmp.bmp?extra=QnkMoPcHh8Pcl9kFUIDvMGE9HrYxZTxMWrVO2SS1Sx4yHP5Q5kT-e7Goat-vWaxmZ-PrrfXp6boVtQQQstdn1i8BSip7NETyr912uQxRlY6BUbMA12qEMoVwuodJKRgPCPb3fkIKpOycnGY0kg
whois
RU VKontakte Ltd 95.142.206.1 clean
https://vk.com/doc647736509_665757334?hash=BLle7vdX3iFMB4azpVJZYs9WrN6tEhp1wsHXrbQ6Ufz&dl=vr8PySakhGw7js63wfoBEncgnNsFZVbFO8czAHxd9Bk&api=1&no_preview=1#WW1
whois
RU VKontakte Ltd 93.186.225.194 mailcious
https://sun6-21.userapi.com/c235131/u647736509/docs/d12/1252c115442f/nudik.bmp?extra=DGoaqLEDsZ3vggeRfdmskz6ZM5azb77zzwL--59fZ45MDdw0qPOQf4y41LDFhStRPPoi2amvgrWPc6qnVp05BabutIeih26aH5tGiyYUTSF4JVORJU74v-DDmHCRMMAC6I3T2FLrjzABvjQEBQ
whois
RU VKontakte Ltd 95.142.206.1 clean
https://sun6-23.userapi.com/c909628/u647736509/docs/d6/739bc3acf24e/RisePro.bmp?extra=4CuDyfIZuYP0bK3ZthEhDyIY7JTcPdNDWB-xWugKYKMzm7GYkAaCWBmMPL-CeiDi5CKnAyxfeLzY30Q5g8hsgJz_kOpQ4VpvA10LWfEQdi1KZEwr-PlrVfsWuYLypMmNjbUlSwPqmc2w3ipuOQ
whois
RU VKontakte Ltd 95.142.206.3 clean
https://vk.com/doc791620691_663065029?hash=Efubo9FQtw3Bdj42XJVcJwymfIH3PazMKz8g5wJ0dZX&dl=G44TCNRSGA3DSMI:1682787066:QgrgzF33wDt9bwmmOgWCYTv61J7HwhLVZOXGaEdWiKP&api=1&no_preview=1#stats
whois
RU VKontakte Ltd 93.186.225.194 mailcious
https://vk.com/doc647736509_665789779?hash=apIBNy1YzIlgOTOme2DjZEPMlC8mQMOrnNK6KuFrvTc&dl=KncEUWyJtdzd8EZ0lpauSTMDceKmPJX1qASzGUdtBnw&api=1&no_preview=1#nudik
whois
RU VKontakte Ltd 93.186.225.194 clean
db-ip.com
whois
US CLOUDFLARENET 172.67.75.166 clean
learn.microsoft.com
whois
US Akamai International B.V. 23.200.154.53 clean
z.nnnaajjjgc.com
whois
US HK Kwaifong Group Limited 156.236.72.121 malware
api.myip.com
whois
US CLOUDFLARENET 104.26.9.59 clean
www.maxmind.com
whois
US CLOUDFLARENET 104.17.214.67 clean
iplis.ru
whois
DE Hetzner Online GmbH 148.251.234.93 mailcious
sun6-22.userapi.com
whois
RU VKontakte Ltd 95.142.206.2 clean
busell.store
whois
US CLOUDFLARENET 172.67.159.178 malware
zzz.fhauiehgha.com
whois
HK HK Kwaifong Group Limited 103.100.211.218 mailcious
sun6-21.userapi.com
whois
RU VKontakte Ltd 95.142.206.1 mailcious
ipinfo.io
whois
US GOOGLE 34.117.59.81 clean
bitbucket.org
whois
US ATLASSIAN PTY LTD 104.192.141.1 malware
sun6-23.userapi.com
whois
RU VKontakte Ltd 95.142.206.3 clean
vk.com
whois
RU VKontakte Ltd 87.240.132.78 mailcious
iplogger.org
whois
DE Hetzner Online GmbH 148.251.234.83 mailcious
api.db-ip.com
whois
US CLOUDFLARENET 172.67.75.166 clean
transfer.sh
whois
DE Hetzner Online GmbH 144.76.136.153 malware
148.251.234.93
whois
DE Hetzner Online GmbH 148.251.234.93 mailcious
194.169.175.128
whois
Unknown 194.169.175.128 mailcious
93.186.225.194
whois
RU VKontakte Ltd 93.186.225.194 mailcious
104.192.141.1
whois
US ATLASSIAN PTY LTD 104.192.141.1 mailcious
208.67.104.60
whois
Unknown 208.67.104.60 mailcious
87.121.221.58
whois
Unknown 87.121.221.58 malware
61.111.58.34
whois
KR LG DACOM Corporation 61.111.58.34 malware
172.67.75.166
whois
US CLOUDFLARENET 172.67.75.166 clean
172.67.75.163
whois
US CLOUDFLARENET 172.67.75.163 clean
193.233.254.61
whois
RU OOO FREEnet Group 193.233.254.61 mailcious
194.26.135.162
whois
Unknown 194.26.135.162 mailcious
23.219.70.2
whois
US CLARO S.A. 23.219.70.2 clean
148.251.234.83
whois
DE Hetzner Online GmbH 148.251.234.83 clean
104.21.9.89
whois
US CLOUDFLARENET 104.21.9.89 malware
34.117.59.81
whois
US GOOGLE 34.117.59.81 clean
45.15.156.229
whois
RU CJSC Kolomna-Sviaz TV 45.15.156.229 mailcious
194.169.175.233
whois
Unknown 194.169.175.233 malware
94.142.138.131
whois
RU Ihor Hosting LLC 94.142.138.131 mailcious
144.76.136.153
whois
DE Hetzner Online GmbH 144.76.136.153 mailcious
77.91.124.231
whois
RU Foton Telecom CJSC 77.91.124.231 malware
104.17.214.67
whois
US CLOUDFLARENET 104.17.214.67 clean
149.202.0.242
whois
FR OVH SAS 149.202.0.242 clean
156.236.72.121
whois
US HK Kwaifong Group Limited 156.236.72.121 mailcious
23.67.53.17
whois
US Akamai International B.V. 23.67.53.17 clean
95.142.206.3
whois
RU VKontakte Ltd 95.142.206.3 clean
163.123.143.4
whois
Unknown 163.123.143.4 mailcious
95.142.206.1
whois
RU VKontakte Ltd 95.142.206.1 mailcious
77.91.124.54
whois
RU Foton Telecom CJSC 77.91.124.54 mailcious
95.142.206.2
whois
RU VKontakte Ltd 95.142.206.2 clean
103.100.211.218
whois
HK HK Kwaifong Group Limited 103.100.211.218 malware
185.244.181.112
whois
Unknown 185.244.181.112 clean

Suricata ids


Similarity measure (PE file only) - Checking for service failure