Report - xx.ps1

Hide_EXE Generic Malware Antivirus AntiDebug AntiVM
ScreenShot
Created 2024.12.16 18:40 Machine s1_win7_x6403
Filename xx.ps1
Type ASCII text, with very long lines, with CRLF line terminators
AI Score Not founds Behavior Score
10.0
ZERO API file : clean
VT API (file) 25 detected (PowerShell, msilheracles, many, Attribute, HighConfidence, TOPIS, ZeM9c7m32mK, Detected, Formbook, AMCT, ABTrojan, UGSW, Ncnw, Encpe, Wacatac, B9nj)
md5 f69b016d952adc017710ec876b525327
sha256 f501e8beb30f182bc162d14575ee29632bf20e91795680f3ca920545ff1e80e5
ssdeep 6144:lLd9qzqbM7iCFFGkqGgsYkzd9JpExVcZ1WCrKNkybbZTVVPIrzxcdt:l5szKwtFGkf5dLOqWzmKbZTUfOr
imphash
impfuzzy
  Network IP location

Signature (18cnts)

Level Description
danger The process powershell.exe wrote an executable file to disk which it then attempted to execute
danger Executed a process and injected code into it
warning File has been identified by 25 AntiVirus engines on VirusTotal as malicious
watch Allocates execute permission to another process indicative of possible code injection
watch Code injection by writing an executable or DLL to the memory of another process
watch One or more non-whitelisted processes were created
watch One or more of the buffers contains an embedded PE file
watch Potential code injection by writing to the memory of another process
watch Resumed a suspended thread in a remote process potentially indicative of process injection
watch Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice Creates executable files on the filesystem
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Sends data using the HTTP POST Method
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger

Rules (11cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (download)
warning hide_executable_file Hide executable file binaries (upload)
watch Antivirus Contains references to security software binaries (download)
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (6cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://www.sqlite.org/2019/sqlite-dll-win32-x86-3300000.zip US Linode, LLC 45.33.6.223 clean
http://www.duwixushx.xyz/bmve/?zER=Rsosln+CouPFD70u1OPXKbJXElFmgu5R0Qz9VzezY2yTYUIF1+nb21DIy1pFOudDIiHjy9JJbERJh7u1Q7B4QPYwE9D6Fj3j1eiWNaQYDUG6o+zT283k7NP57saUsP2d80o7rJ4=&cAItz=FLvgQyU9b0YI ZA POWER LINE DATACENTER 156.251.17.224 clean
http://www.duwixushx.xyz/bmve/ ZA POWER LINE DATACENTER 156.251.17.224 clean
www.duwixushx.xyz ZA POWER LINE DATACENTER 156.251.17.224 clean
156.251.17.224 ZA POWER LINE DATACENTER 156.251.17.224 clean
45.33.6.223 US Linode, LLC 45.33.6.223 clean

Suricata ids



Similarity measure (PE file only) - Checking for service failure