Report - nj.exe

Malicious Library .NET framework(MSIL) UPX PE File .NET EXE PE32 OS Processor Check
ScreenShot
Created 2024.12.19 08:42 Machine s1_win7_x6403
Filename nj.exe
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
AI Score
6
Behavior Score
2.0
ZERO API file : clean
VT API (file) 59 detected (AIDetectMalware, Quasar, TRFH927, PasswordStealerA, Unsafe, Save, malicious, confidence, 100%, Attribute, HighConfidence, Windows, Threat, CLASSIC, AGEN, PackedNet, Static AI, Malicious PE, aogzw, Detected, atmn, Eldorado, QuasarRAT, R341693, GenericRXMC, gC2+FVQst2Q, susgen, server)
md5 fd683344e5fc0a2dc8693f32ff45bf1f
sha256 4c15728c688fd0ef27d2effeb6e37f8b05f104dc07da04926b8e0386b5e58a0e
ssdeep 49152:qvVt62XlaSFNWPjljiFa2RoUYI7mcH+mZHLo0dPBNTHHB72eh2NT:qvn62XlaSFNWPjljiFXRoUYIicHBtB
imphash f34d5f2d4577ed6d9ceec516c1f5a744
impfuzzy 3:rGsLdAIEK:tf
  Network IP location

Signature (4cnts)

Level Description
danger File has been identified by 59 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
info Checks amount of memory in system
info Checks if process is being debugged by a debugger

Rules (7cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
watch Win32_Trojan_PWS_Net_1_Zero Win32 Trojan PWS .NET Azorult binaries (upload)
info Is_DotNET_EXE (no description) binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

mscoree.dll
 0x402000 _CorExeMain

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure