Report - arch1208_0924.7z

Escalate priviledges PWS KeyLogger AntiDebug AntiVM
ScreenShot
Created 2024.08.13 10:44 Machine s1_win7_x6402
Filename arch1208_0924.7z
Type 7-zip archive data, version 0.4
AI Score Not founds Behavior Score
1.6
ZERO API file : clean
VT API (file)
md5 f6b650c35ed4de1040e590b400db1ef3
sha256 55923403665074596a823e4a15f18da74337021926d04a2b96e83ac446c4603f
ssdeep 393216:q/7ryWN4uTGFj2CD5VvRYJe2iSzs5ldEfGLD0T9NZFM1xsnUNBl:ardN4qGJVZ8nzsndAGcRFM1G+l
imphash
impfuzzy
  Network IP location

Signature (5cnts)

Level Description
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger

Rules (11cnts)

Level Name Description Collection
notice Escalate_priviledges Escalate priviledges memory
notice Generic_PWS_Memory_Zero PWS Memory memory
notice KeyLogger Run a KeyLogger memory
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids



Similarity measure (PE file only) - Checking for service failure