Report - albt.exe

Malicious Library UPX PE File PE32 MZP Format
ScreenShot
Created 2025.01.07 15:47 Machine s1_win7_x6403
Filename albt.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score Not founds Behavior Score
3.6
ZERO API file : clean
VT API (file) 46 detected (AIDetectMalware, ModiLoader, Malicious, score, Unsafe, Vkce, confidence, GenericKD, Attribute, HighConfidence, high confidence, GenKryptik, HFGI, BackdoorX, Androm, CLASSIC, DownLoader48, moderate, Static AI, Suspicious PE, Detected, Nekark, tuies, DRXNE8, Eldorado, Artemis, Krypt, GdSda, susgen, D#I2XJC)
md5 bf9b75adf866583299dbc8a5fad66cfc
sha256 1bec44aa19ea8daa0b7151b312975f3f753e03f0bbce5ebeab8dfda5fb736a91
ssdeep 24576:Gw6yj+R7ydItm/2uQAGYDKAVcpzWc4ctu:GDBR2KTYDKArc4Ku
imphash 44c8864bd68c3bff94639c69671ea4b7
impfuzzy 96:oO4nYU3Me0M4buu21xSUvK9eVsoWGXy7aXepeU8JS10+Y4DwPOQCe:o13MDbuu0xSUvK9kso1Xy7aFG1QhPOQ9
  Network IP location

Signature (8cnts)

Level Description
danger File has been identified by 46 AntiVirus engines on VirusTotal as malicious
watch Disables proxy possibly for traffic interception
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks if process is being debugged by a debugger
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The executable uses a known packer

Rules (5cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info mzp_file_format MZP(Delphi) file format binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (1cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
amazonenviro.com US AS-26496-GO-DADDY-COM-LLC 166.62.27.188 clean

Suricata ids

PE API

IAT(Import Address Table) Library

oleaut32.dll
 0x475754 SysFreeString
 0x475758 SysReAllocStringLen
 0x47575c SysAllocStringLen
advapi32.dll
 0x475764 RegQueryValueExA
 0x475768 RegOpenKeyExA
 0x47576c RegCloseKey
user32.dll
 0x475774 GetKeyboardType
 0x475778 DestroyWindow
 0x47577c LoadStringA
 0x475780 MessageBoxA
 0x475784 CharNextA
kernel32.dll
 0x47578c GetACP
 0x475790 Sleep
 0x475794 VirtualFree
 0x475798 VirtualAlloc
 0x47579c GetCurrentThreadId
 0x4757a0 InterlockedDecrement
 0x4757a4 InterlockedIncrement
 0x4757a8 VirtualQuery
 0x4757ac WideCharToMultiByte
 0x4757b0 MultiByteToWideChar
 0x4757b4 lstrlenA
 0x4757b8 lstrcpynA
 0x4757bc LoadLibraryExA
 0x4757c0 GetThreadLocale
 0x4757c4 GetStartupInfoA
 0x4757c8 GetProcAddress
 0x4757cc GetModuleHandleA
 0x4757d0 GetModuleFileNameA
 0x4757d4 GetLocaleInfoA
 0x4757d8 GetCommandLineA
 0x4757dc FreeLibrary
 0x4757e0 FindFirstFileA
 0x4757e4 FindClose
 0x4757e8 ExitProcess
 0x4757ec CompareStringA
 0x4757f0 WriteFile
 0x4757f4 UnhandledExceptionFilter
 0x4757f8 RtlUnwind
 0x4757fc RaiseException
 0x475800 GetStdHandle
kernel32.dll
 0x475808 TlsSetValue
 0x47580c TlsGetValue
 0x475810 LocalAlloc
 0x475814 GetModuleHandleA
user32.dll
 0x47581c CreateWindowExA
 0x475820 WindowFromPoint
 0x475824 WaitMessage
 0x475828 UpdateWindow
 0x47582c UnregisterClassA
 0x475830 UnhookWindowsHookEx
 0x475834 TranslateMessage
 0x475838 TranslateMDISysAccel
 0x47583c TrackPopupMenu
 0x475840 SystemParametersInfoA
 0x475844 ShowWindow
 0x475848 ShowScrollBar
 0x47584c ShowOwnedPopups
 0x475850 SetWindowsHookExA
 0x475854 SetWindowPos
 0x475858 SetWindowPlacement
 0x47585c SetWindowLongW
 0x475860 SetWindowLongA
 0x475864 SetTimer
 0x475868 SetScrollRange
 0x47586c SetScrollPos
 0x475870 SetScrollInfo
 0x475874 SetRect
 0x475878 SetPropA
 0x47587c SetParent
 0x475880 SetMenuItemInfoA
 0x475884 SetMenu
 0x475888 SetForegroundWindow
 0x47588c SetFocus
 0x475890 SetCursor
 0x475894 SetClassLongA
 0x475898 SetCapture
 0x47589c SetActiveWindow
 0x4758a0 SendMessageW
 0x4758a4 SendMessageA
 0x4758a8 ScrollWindow
 0x4758ac ScreenToClient
 0x4758b0 RemovePropA
 0x4758b4 RemoveMenu
 0x4758b8 ReleaseDC
 0x4758bc ReleaseCapture
 0x4758c0 RegisterWindowMessageA
 0x4758c4 RegisterClipboardFormatA
 0x4758c8 RegisterClassA
 0x4758cc RedrawWindow
 0x4758d0 PtInRect
 0x4758d4 PostQuitMessage
 0x4758d8 PostMessageA
 0x4758dc PeekMessageW
 0x4758e0 PeekMessageA
 0x4758e4 OffsetRect
 0x4758e8 OemToCharA
 0x4758ec MessageBoxA
 0x4758f0 MapWindowPoints
 0x4758f4 MapVirtualKeyA
 0x4758f8 LoadStringA
 0x4758fc LoadKeyboardLayoutA
 0x475900 LoadIconA
 0x475904 LoadCursorA
 0x475908 LoadBitmapA
 0x47590c KillTimer
 0x475910 IsZoomed
 0x475914 IsWindowVisible
 0x475918 IsWindowUnicode
 0x47591c IsWindowEnabled
 0x475920 IsWindow
 0x475924 IsRectEmpty
 0x475928 IsIconic
 0x47592c IsDialogMessageW
 0x475930 IsDialogMessageA
 0x475934 IsChild
 0x475938 InvalidateRect
 0x47593c IntersectRect
 0x475940 InsertMenuItemA
 0x475944 InsertMenuA
 0x475948 InflateRect
 0x47594c GetWindowThreadProcessId
 0x475950 GetWindowTextA
 0x475954 GetWindowRect
 0x475958 GetWindowPlacement
 0x47595c GetWindowLongW
 0x475960 GetWindowLongA
 0x475964 GetWindowDC
 0x475968 GetTopWindow
 0x47596c GetSystemMetrics
 0x475970 GetSystemMenu
 0x475974 GetSysColorBrush
 0x475978 GetSysColor
 0x47597c GetSubMenu
 0x475980 GetScrollRange
 0x475984 GetScrollPos
 0x475988 GetScrollInfo
 0x47598c GetPropA
 0x475990 GetParent
 0x475994 GetWindow
 0x475998 GetMessagePos
 0x47599c GetMenuStringA
 0x4759a0 GetMenuState
 0x4759a4 GetMenuItemInfoA
 0x4759a8 GetMenuItemID
 0x4759ac GetMenuItemCount
 0x4759b0 GetMenu
 0x4759b4 GetLastActivePopup
 0x4759b8 GetKeyboardState
 0x4759bc GetKeyboardLayoutNameA
 0x4759c0 GetKeyboardLayoutList
 0x4759c4 GetKeyboardLayout
 0x4759c8 GetKeyState
 0x4759cc GetKeyNameTextA
 0x4759d0 GetIconInfo
 0x4759d4 GetForegroundWindow
 0x4759d8 GetFocus
 0x4759dc GetDlgItem
 0x4759e0 GetDesktopWindow
 0x4759e4 GetDCEx
 0x4759e8 GetDC
 0x4759ec GetCursorPos
 0x4759f0 GetCursor
 0x4759f4 GetClientRect
 0x4759f8 GetClassLongA
 0x4759fc GetClassInfoA
 0x475a00 GetCapture
 0x475a04 GetActiveWindow
 0x475a08 FrameRect
 0x475a0c FindWindowA
 0x475a10 FillRect
 0x475a14 EqualRect
 0x475a18 EnumWindows
 0x475a1c EnumThreadWindows
 0x475a20 EnumChildWindows
 0x475a24 EndPaint
 0x475a28 EnableWindow
 0x475a2c EnableScrollBar
 0x475a30 EnableMenuItem
 0x475a34 DrawTextA
 0x475a38 DrawMenuBar
 0x475a3c DrawIconEx
 0x475a40 DrawIcon
 0x475a44 DrawFrameControl
 0x475a48 DrawFocusRect
 0x475a4c DrawEdge
 0x475a50 DispatchMessageW
 0x475a54 DispatchMessageA
 0x475a58 DestroyWindow
 0x475a5c DestroyMenu
 0x475a60 DestroyIcon
 0x475a64 DestroyCursor
 0x475a68 DeleteMenu
 0x475a6c DefWindowProcA
 0x475a70 DefMDIChildProcA
 0x475a74 DefFrameProcA
 0x475a78 CreatePopupMenu
 0x475a7c CreateMenu
 0x475a80 CreateIcon
 0x475a84 ClientToScreen
 0x475a88 CheckMenuItem
 0x475a8c CallWindowProcA
 0x475a90 CallNextHookEx
 0x475a94 BeginPaint
 0x475a98 CharNextA
 0x475a9c CharLowerA
 0x475aa0 CharToOemA
 0x475aa4 AdjustWindowRectEx
 0x475aa8 ActivateKeyboardLayout
gdi32.dll
 0x475ab0 UnrealizeObject
 0x475ab4 StretchBlt
 0x475ab8 SetWindowOrgEx
 0x475abc SetViewportOrgEx
 0x475ac0 SetTextColor
 0x475ac4 SetStretchBltMode
 0x475ac8 SetROP2
 0x475acc SetPixel
 0x475ad0 SetDIBColorTable
 0x475ad4 SetBrushOrgEx
 0x475ad8 SetBkMode
 0x475adc SetBkColor
 0x475ae0 SelectPalette
 0x475ae4 SelectObject
 0x475ae8 SaveDC
 0x475aec RestoreDC
 0x475af0 RectVisible
 0x475af4 RealizePalette
 0x475af8 Polyline
 0x475afc PatBlt
 0x475b00 MoveToEx
 0x475b04 MaskBlt
 0x475b08 LineTo
 0x475b0c IntersectClipRect
 0x475b10 GetWindowOrgEx
 0x475b14 GetTextMetricsA
 0x475b18 GetTextExtentPoint32A
 0x475b1c GetSystemPaletteEntries
 0x475b20 GetStockObject
 0x475b24 GetRgnBox
 0x475b28 GetPixel
 0x475b2c GetPaletteEntries
 0x475b30 GetObjectA
 0x475b34 GetDeviceCaps
 0x475b38 GetDIBits
 0x475b3c GetDIBColorTable
 0x475b40 GetDCOrgEx
 0x475b44 GetCurrentPositionEx
 0x475b48 GetClipBox
 0x475b4c GetBrushOrgEx
 0x475b50 GetBitmapBits
 0x475b54 GdiFlush
 0x475b58 ExcludeClipRect
 0x475b5c DeleteObject
 0x475b60 DeleteDC
 0x475b64 CreateSolidBrush
 0x475b68 CreatePenIndirect
 0x475b6c CreatePalette
 0x475b70 CreateHalftonePalette
 0x475b74 CreateFontIndirectA
 0x475b78 CreateDIBitmap
 0x475b7c CreateDIBSection
 0x475b80 CreateCompatibleDC
 0x475b84 CreateCompatibleBitmap
 0x475b88 CreateBrushIndirect
 0x475b8c CreateBitmap
 0x475b90 BitBlt
version.dll
 0x475b98 VerQueryValueA
 0x475b9c GetFileVersionInfoSizeA
 0x475ba0 GetFileVersionInfoA
kernel32.dll
 0x475ba8 lstrcpyA
 0x475bac lstrcatA
 0x475bb0 _lread
 0x475bb4 _lopen
 0x475bb8 _llseek
 0x475bbc _lclose
 0x475bc0 WriteFile
 0x475bc4 WaitForSingleObject
 0x475bc8 VirtualQuery
 0x475bcc VirtualAlloc
 0x475bd0 SizeofResource
 0x475bd4 SetThreadLocale
 0x475bd8 SetFilePointer
 0x475bdc SetEvent
 0x475be0 SetErrorMode
 0x475be4 SetEndOfFile
 0x475be8 ResetEvent
 0x475bec ReadFile
 0x475bf0 MultiByteToWideChar
 0x475bf4 MulDiv
 0x475bf8 LockResource
 0x475bfc LoadResource
 0x475c00 LoadLibraryA
 0x475c04 LeaveCriticalSection
 0x475c08 InitializeCriticalSection
 0x475c0c GlobalFindAtomA
 0x475c10 GlobalDeleteAtom
 0x475c14 GlobalAddAtomA
 0x475c18 GetVersionExA
 0x475c1c GetVersion
 0x475c20 GetTickCount
 0x475c24 GetThreadLocale
 0x475c28 GetStdHandle
 0x475c2c GetProcAddress
 0x475c30 GetModuleHandleA
 0x475c34 GetModuleFileNameA
 0x475c38 GetLocaleInfoA
 0x475c3c GetLocalTime
 0x475c40 GetLastError
 0x475c44 GetFullPathNameA
 0x475c48 GetDiskFreeSpaceA
 0x475c4c GetDateFormatA
 0x475c50 GetCurrentThreadId
 0x475c54 GetCurrentProcessId
 0x475c58 GetCPInfo
 0x475c5c FreeResource
 0x475c60 InterlockedExchange
 0x475c64 FreeLibrary
 0x475c68 FormatMessageA
 0x475c6c FindResourceA
 0x475c70 EnumCalendarInfoA
 0x475c74 EnterCriticalSection
 0x475c78 DeleteCriticalSection
 0x475c7c CreateThread
 0x475c80 CreateFileA
 0x475c84 CreateEventA
 0x475c88 CompareStringA
 0x475c8c CloseHandle
advapi32.dll
 0x475c94 RegQueryValueExA
 0x475c98 RegOpenKeyExA
 0x475c9c RegFlushKey
 0x475ca0 RegCloseKey
oleaut32.dll
 0x475ca8 CreateErrorInfo
 0x475cac GetErrorInfo
 0x475cb0 SetErrorInfo
 0x475cb4 SysFreeString
ole32.dll
 0x475cbc CoCreateInstance
 0x475cc0 CoUninitialize
 0x475cc4 CoInitialize
kernel32.dll
 0x475ccc Sleep
oleaut32.dll
 0x475cd4 SafeArrayPtrOfIndex
 0x475cd8 SafeArrayGetUBound
 0x475cdc SafeArrayGetLBound
 0x475ce0 SafeArrayCreate
 0x475ce4 VariantChangeType
 0x475ce8 VariantCopy
 0x475cec VariantClear
 0x475cf0 VariantInit
comctl32.dll
 0x475cf8 _TrackMouseEvent
 0x475cfc ImageList_SetIconSize
 0x475d00 ImageList_GetIconSize
 0x475d04 ImageList_Write
 0x475d08 ImageList_Read
 0x475d0c ImageList_DragShowNolock
 0x475d10 ImageList_DragMove
 0x475d14 ImageList_DragLeave
 0x475d18 ImageList_DragEnter
 0x475d1c ImageList_EndDrag
 0x475d20 ImageList_BeginDrag
 0x475d24 ImageList_Remove
 0x475d28 ImageList_DrawEx
 0x475d2c ImageList_Draw
 0x475d30 ImageList_GetBkColor
 0x475d34 ImageList_SetBkColor
 0x475d38 ImageList_Add
 0x475d3c ImageList_GetImageCount
 0x475d40 ImageList_Destroy
 0x475d44 ImageList_Create
comdlg32.dll
 0x475d4c GetOpenFileNameA

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure