ScreenShot
| Created | 2024.09.19 09:41 | Machine | s1_win7_x6401 |
| Filename | trueburner.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 44 detected (AIDetectMalware, Vi17, GenericKD, Genus, Attribute, HighConfidence, a variant of WinGo, Malicious, TrojanPSW, Lumma, CLASSIC, hlkll, LUMMASTEALER, YXEIQZ, moderate, score, WinGo, Detected, Malware@#1n1d58jghhx5p, Sabsik, ABTrojan, BEHB, LummaC2, Artemis, Chgt, QQPass, QQRob, Vimw) | ||
| md5 | 1f51751ae5a114af8b47a3f6ee663bec | ||
| sha256 | d5f9727b5eaf22932b9d957d74c355e14b2f8ffb2f18eb0326336f00889d9e42 | ||
| ssdeep | 49152:3mctNNaV0+TTl/AWlSOcfK+8hxR89PUlQhWkpXn4YQOTzUfkWksXTjTlwv2eORTT:2ctNyTp/AWhct9Pz/Driv88u | ||
| imphash | 1aae8bf580c846f39c71c05898e57e88 | ||
| impfuzzy | 24:ibVjh9wO+VuT7boVaXOr6kwmDgUPMztxdEr6UP:AwO+VUjXOmokx0nP | ||
Network IP location
Signature (2cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 44 AntiVirus engines on VirusTotal as malicious |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (8cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | DllRegisterServer_Zero | execute regsvr32.exe | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
kernel32.dll
0xa66a00 WriteFile
0xa66a04 WriteConsoleW
0xa66a08 WerSetFlags
0xa66a0c WerGetFlags
0xa66a10 WaitForMultipleObjects
0xa66a14 WaitForSingleObject
0xa66a18 VirtualQuery
0xa66a1c VirtualFree
0xa66a20 VirtualAlloc
0xa66a24 TlsAlloc
0xa66a28 SwitchToThread
0xa66a2c SuspendThread
0xa66a30 SetWaitableTimer
0xa66a34 SetUnhandledExceptionFilter
0xa66a38 SetProcessPriorityBoost
0xa66a3c SetEvent
0xa66a40 SetErrorMode
0xa66a44 SetConsoleCtrlHandler
0xa66a48 ResumeThread
0xa66a4c RaiseFailFastException
0xa66a50 PostQueuedCompletionStatus
0xa66a54 LoadLibraryW
0xa66a58 LoadLibraryExW
0xa66a5c SetThreadContext
0xa66a60 GetThreadContext
0xa66a64 GetSystemInfo
0xa66a68 GetSystemDirectoryA
0xa66a6c GetStdHandle
0xa66a70 GetQueuedCompletionStatusEx
0xa66a74 GetProcessAffinityMask
0xa66a78 GetProcAddress
0xa66a7c GetErrorMode
0xa66a80 GetEnvironmentStringsW
0xa66a84 GetCurrentThreadId
0xa66a88 GetConsoleMode
0xa66a8c FreeEnvironmentStringsW
0xa66a90 ExitProcess
0xa66a94 DuplicateHandle
0xa66a98 CreateWaitableTimerExW
0xa66a9c CreateThread
0xa66aa0 CreateIoCompletionPort
0xa66aa4 CreateEventA
0xa66aa8 CloseHandle
0xa66aac AddVectoredExceptionHandler
EAT(Export Address Table) is none
kernel32.dll
0xa66a00 WriteFile
0xa66a04 WriteConsoleW
0xa66a08 WerSetFlags
0xa66a0c WerGetFlags
0xa66a10 WaitForMultipleObjects
0xa66a14 WaitForSingleObject
0xa66a18 VirtualQuery
0xa66a1c VirtualFree
0xa66a20 VirtualAlloc
0xa66a24 TlsAlloc
0xa66a28 SwitchToThread
0xa66a2c SuspendThread
0xa66a30 SetWaitableTimer
0xa66a34 SetUnhandledExceptionFilter
0xa66a38 SetProcessPriorityBoost
0xa66a3c SetEvent
0xa66a40 SetErrorMode
0xa66a44 SetConsoleCtrlHandler
0xa66a48 ResumeThread
0xa66a4c RaiseFailFastException
0xa66a50 PostQueuedCompletionStatus
0xa66a54 LoadLibraryW
0xa66a58 LoadLibraryExW
0xa66a5c SetThreadContext
0xa66a60 GetThreadContext
0xa66a64 GetSystemInfo
0xa66a68 GetSystemDirectoryA
0xa66a6c GetStdHandle
0xa66a70 GetQueuedCompletionStatusEx
0xa66a74 GetProcessAffinityMask
0xa66a78 GetProcAddress
0xa66a7c GetErrorMode
0xa66a80 GetEnvironmentStringsW
0xa66a84 GetCurrentThreadId
0xa66a88 GetConsoleMode
0xa66a8c FreeEnvironmentStringsW
0xa66a90 ExitProcess
0xa66a94 DuplicateHandle
0xa66a98 CreateWaitableTimerExW
0xa66a9c CreateThread
0xa66aa0 CreateIoCompletionPort
0xa66aa4 CreateEventA
0xa66aa8 CloseHandle
0xa66aac AddVectoredExceptionHandler
EAT(Export Address Table) is none