Edit tour
Windows
Analysis Report
zyJWi2vy29.exe
Overview
General Information
Sample name: | zyJWi2vy29.exerenamed because original name is a hash value |
Original sample name: | 97768ab0a4837757b74de2ae892badab.exe |
Analysis ID: | 1465070 |
MD5: | 97768ab0a4837757b74de2ae892badab |
SHA1: | d8bdfdb717b64ee4cd7a892bbddd293f7eaf915c |
SHA256: | 0f88ea51a56da966d12311a4b20ea3a6c44315e00747a589f19cf535f90ced77 |
Tags: | 32exetrojan |
Infos: | |
Detection
LummaC, PureLog Stealer, RisePro Stealer, Vidar, zgRAT
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected PureLog Stealer
Yara detected RisePro Stealer
Yara detected Vidar stealer
Yara detected zgRAT
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Creates multiple autostart registry keys
Found API chain indicative of sandbox detection
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found many strings related to Crypto-Wallets (likely being stolen)
Found stalling execution ending in API Sleep call
Injects a PE file into a foreign processes
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to detect sandboxes (mouse cursor move detection)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Enables security privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found decision node followed by non-executed suspicious APIs
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches for user specific document files
Sigma detected: CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses the system / local time for branch decision (may execute only at specific dates)
Yara detected Credential Stealer
Yara signature match
Classification
- System is w10x64
- zyJWi2vy29.exe (PID: 7548 cmdline:
"C:\Users\ user\Deskt op\zyJWi2v y29.exe" MD5: 97768AB0A4837757B74DE2AE892BADAB) - conhost.exe (PID: 7556 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - RegAsm.exe (PID: 7616 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Asm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13) - RegAsm.exe (PID: 7624 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Asm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13) - WerFault.exe (PID: 7632 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -pss -s 472 -p 75 48 -ip 754 8 MD5: C31336C1EFC2CCB44B4326EA793040F2) - schtasks.exe (PID: 7908 cmdline:
schtasks / create /f /RU "user" /tr "C:\P rogramData \MSIUpdate rV168_6a6c 6289978e81 e233ec951d d09be6ea\M SIUpdaterV 168.exe" / tn "MSIUpd aterV168_6 a6c6289978 e81e233ec9 51dd09be6e a HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 7916 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - schtasks.exe (PID: 7956 cmdline:
schtasks / create /f /RU "user" /tr "C:\P rogramData \MSIUpdate rV168_6a6c 6289978e81 e233ec951d d09be6ea\M SIUpdaterV 168.exe" / tn "MSIUpd aterV168_6 a6c6289978 e81e233ec9 51dd09be6e a LG" /sc ONLOGON /r l HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 7964 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - 6p7a7injLZJojhETBNhL.exe (PID: 8004 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\span3q yfLZqnmIGj \6p7a7injL ZJojhETBNh L.exe" MD5: 97768AB0A4837757B74DE2AE892BADAB) - conhost.exe (PID: 8012 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - RegAsm.exe (PID: 8188 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Asm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13) - WerFault.exe (PID: 4908 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 8 004 -s 284 MD5: C31336C1EFC2CCB44B4326EA793040F2) - schtasks.exe (PID: 8084 cmdline:
schtasks / create /f /RU "user" /tr "C:\P rogramData \MSIUpdate rV168_e08a 8d55b50864 bc6ca07cda 5a9c96c8\M SIUpdaterV 168.exe" / tn "MSIUpd aterV168_e 08a8d55b50 864bc6ca07 cda5a9c96c 8 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 8112 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - schtasks.exe (PID: 8144 cmdline:
schtasks / create /f /RU "user" /tr "C:\P rogramData \MSIUpdate rV168_e08a 8d55b50864 bc6ca07cda 5a9c96c8\M SIUpdaterV 168.exe" / tn "MSIUpd aterV168_e 08a8d55b50 864bc6ca07 cda5a9c96c 8 LG" /sc ONLOGON /r l HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 8160 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - 8x9h3ctqkpfTu0sNF0X2.exe (PID: 7268 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\span3q yfLZqnmIGj \8x9h3ctqk pfTu0sNF0X 2.exe" MD5: F88272EA7674D3ACEDD8ADCF7643C598) - RegAsm.exe (PID: 7236 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Asm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13) - WerFault.exe (PID: 428 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 7 268 -s 288 MD5: C31336C1EFC2CCB44B4326EA793040F2) - schtasks.exe (PID: 6100 cmdline:
schtasks / create /f /RU "user" /tr "C:\P rogramData \MSIUpdate rV168_9602 278fd5a666 ce6ca3a5ad 676c9c5a\M SIUpdaterV 168.exe" / tn "MSIUpd aterV168_9 602278fd5a 666ce6ca3a 5ad676c9c5 a HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 3752 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - schtasks.exe (PID: 1136 cmdline:
schtasks / create /f /RU "user" /tr "C:\P rogramData \MSIUpdate rV168_9602 278fd5a666 ce6ca3a5ad 676c9c5a\M SIUpdaterV 168.exe" / tn "MSIUpd aterV168_9 602278fd5a 666ce6ca3a 5ad676c9c5 a LG" /sc ONLOGON /r l HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 7196 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - 3f61nAONpe1PsLC0oJHy.exe (PID: 7632 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\span3q yfLZqnmIGj \3f61nAONp e1PsLC0oJH y.exe" MD5: 0309DD0131150796EA99B30A62194FAE) - conhost.exe (PID: 7760 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - RegAsm.exe (PID: 7828 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Asm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13) - WerFault.exe (PID: 7856 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 7 632 -s 136 MD5: C31336C1EFC2CCB44B4326EA793040F2) - schtasks.exe (PID: 7868 cmdline:
schtasks / create /f /RU "user" /tr "C:\P rogramData \MSIUpdate rV168_b055 341c05e33d 6c2334ce6d 41cea915\M SIUpdaterV 168.exe" / tn "MSIUpd aterV168_b 055341c05e 33d6c2334c e6d41cea91 5 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 7664 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - schtasks.exe (PID: 7992 cmdline:
schtasks / create /f /RU "user" /tr "C:\P rogramData \MSIUpdate rV168_b055 341c05e33d 6c2334ce6d 41cea915\M SIUpdaterV 168.exe" / tn "MSIUpd aterV168_b 055341c05e 33d6c2334c e6d41cea91 5 LG" /sc ONLOGON /r l HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 7972 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - 8jZLXI789L2zXDjlm7Fx.exe (PID: 8040 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\span3q yfLZqnmIGj \8jZLXI789 L2zXDjlm7F x.exe" MD5: 2FCB3543D06F526E93C7276356F557B7) - conhost.exe (PID: 8032 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - WerFault.exe (PID: 7668 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 7 548 -s 324 MD5: C31336C1EFC2CCB44B4326EA793040F2)
- MSIUpdaterV168.exe (PID: 8076 cmdline:
C:\Program Data\MSIUp daterV168_ 6a6c628997 8e81e233ec 951dd09be6 ea\MSIUpda terV168.ex e MD5: 97768AB0A4837757B74DE2AE892BADAB) - conhost.exe (PID: 8104 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- MSIUpdaterV168.exe (PID: 8096 cmdline:
C:\Program Data\MSIUp daterV168_ 6a6c628997 8e81e233ec 951dd09be6 ea\MSIUpda terV168.ex e MD5: 97768AB0A4837757B74DE2AE892BADAB) - conhost.exe (PID: 8152 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- MSIUpdaterV168.exe (PID: 7560 cmdline:
C:\Program Data\MSIUp daterV168_ 9602278fd5 a666ce6ca3 a5ad676c9c 5a\MSIUpda terV168.ex e MD5: 0309DD0131150796EA99B30A62194FAE) - conhost.exe (PID: 7580 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - RegAsm.exe (PID: 7472 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Asm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
- MSIUpdaterV168.exe (PID: 2504 cmdline:
C:\Program Data\MSIUp daterV168_ e08a8d55b5 0864bc6ca0 7cda5a9c96 c8\MSIUpda terV168.ex e MD5: F88272EA7674D3ACEDD8ADCF7643C598) - RegAsm.exe (PID: 2656 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Asm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
- MSIUpdaterV168.exe (PID: 7744 cmdline:
C:\Program Data\MSIUp daterV168_ e08a8d55b5 0864bc6ca0 7cda5a9c96 c8\MSIUpda terV168.ex e MD5: F88272EA7674D3ACEDD8ADCF7643C598) - RegAsm.exe (PID: 3720 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Asm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
- MSIUpdaterV168.exe (PID: 7988 cmdline:
C:\Program Data\MSIUp daterV168_ 9602278fd5 a666ce6ca3 a5ad676c9c 5a\MSIUpda terV168.ex e MD5: 0309DD0131150796EA99B30A62194FAE) - conhost.exe (PID: 8108 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- MSIUpdaterV168.exe (PID: 8028 cmdline:
C:\Program Data\MSIUp daterV168_ b055341c05 e33d6c2334 ce6d41cea9 15\MSIUpda terV168.ex e MD5: 2FCB3543D06F526E93C7276356F557B7) - conhost.exe (PID: 2840 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- MSIUpdaterV168.exe (PID: 2180 cmdline:
C:\Program Data\MSIUp daterV168_ b055341c05 e33d6c2334 ce6d41cea9 15\MSIUpda terV168.ex e MD5: 2FCB3543D06F526E93C7276356F557B7) - conhost.exe (PID: 7348 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Lumma Stealer, LummaC2 Stealer | Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. | No Attribution |
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Vidar | Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. | No Attribution |
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
zgRAT | zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on. | No Attribution |
{"C2 url": ["pedestriankodwu.xyz", "towerxxuytwi.xyzd", "ellaboratepwsz.xyzu", "penetratedpoopp.xyz", "swellfrrgwwos.xyz", "contintnetksows.shop", "foodypannyjsud.shop", "potterryisiw.shop", "potterryisiw.shop"], "Build id": "H8NgCl--default2806"}
{"C2 url": ["https://steamcommunity.com/profiles/76561199707802586", "https://t.me/g067n"], "Botnet": "254862acdd5c5d2dddb209d751490c15"}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_LummaCStealer_3 | Yara detected LummaC Stealer | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_zgRAT_1 | Yara detected zgRAT | Joe Security | ||
JoeSecurity_PureLogStealer | Yara detected PureLog Stealer | Joe Security | ||
MALWARE_Win_zgRAT | Detects zgRAT | ditekSHen |
| |
JoeSecurity_zgRAT_1 | Yara detected zgRAT | Joe Security | ||
JoeSecurity_PureLogStealer | Yara detected PureLog Stealer | Joe Security | ||
Click to see the 8 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security | ||
JoeSecurity_PureLogStealer | Yara detected PureLog Stealer | Joe Security | ||
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security | ||
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security | ||
JoeSecurity_RiseProStealer | Yara detected RisePro Stealer | Joe Security | ||
Click to see the 13 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_zgRAT_1 | Yara detected zgRAT | Joe Security | ||
JoeSecurity_PureLogStealer | Yara detected PureLog Stealer | Joe Security | ||
MALWARE_Win_zgRAT | Detects zgRAT | ditekSHen |
| |
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security | ||
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security | ||
Click to see the 1 entries |
System Summary |
---|
Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): |
Timestamp: | 07/01/24-09:16:35.352447 |
SID: | 2046266 |
Source Port: | 50500 |
Destination Port: | 49802 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 07/01/24-09:16:07.227239 |
SID: | 2046266 |
Source Port: | 50500 |
Destination Port: | 49747 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 07/01/24-09:16:07.459810 |
SID: | 2046267 |
Source Port: | 50500 |
Destination Port: | 49747 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 07/01/24-09:16:32.178451 |
SID: | 2046266 |
Source Port: | 50500 |
Destination Port: | 49787 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 07/01/24-09:16:06.660397 |
SID: | 2049060 |
Source Port: | 49747 |
Destination Port: | 50500 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 07/01/24-09:16:13.442392 |
SID: | 2046269 |
Source Port: | 49747 |
Destination Port: | 50500 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 07/01/24-09:16:20.238290 |
SID: | 2046266 |
Source Port: | 50500 |
Destination Port: | 49756 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 07/01/24-09:16:32.076820 |
SID: | 2046266 |
Source Port: | 50500 |
Destination Port: | 49786 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Avira: |
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: |
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: |
Source: | Malware Configuration Extractor: | ||
Source: | Malware Configuration Extractor: |
Source: | Virustotal: | Perma Link |
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: |
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link |
Source: | Integrated Neural Analysis Model: |
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: |
Source: | Joe Sandbox ML: |
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: |
Source: | Code function: | 20_2_004C6B00 | |
Source: | Code function: | 24_2_00407E41 | |
Source: | Code function: | 24_2_0040AB80 | |
Source: | Code function: | 24_2_00407DC2 | |
Source: | Code function: | 24_2_0041302D |
Source: | Static PE information: |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | Static PE information: |
Source: | Binary string: |
Source: | Code function: | 0_2_0033AAC7 | |
Source: | Code function: | 10_2_006EAAC7 | |
Source: | Code function: | 20_2_004C6000 | |
Source: | Code function: | 20_2_00432022 | |
Source: | Code function: | 20_2_004E6770 | |
Source: | Code function: | 20_2_004938D0 | |
Source: | Code function: | 20_2_00493B60 | |
Source: | Code function: | 20_2_004DFF00 | |
Source: | Code function: | 20_2_00431F9C | |
Source: | Code function: | 22_2_00E4D43A | |
Source: | Code function: | 24_2_00409FC0 | |
Source: | Code function: | 24_2_0040C039 | |
Source: | Code function: | 24_2_0040C6B5 | |
Source: | Code function: | 24_2_00401443 | |
Source: | Code function: | 24_2_0040BC98 | |
Source: | Code function: | 24_2_004164C7 | |
Source: | Code function: | 24_2_00416D7D | |
Source: | Code function: | 24_2_0041738D | |
Source: | Code function: | 24_2_004177D3 | |
Source: | Code function: | 24_2_0040E016 |
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: |
Networking |
---|
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: |
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: |
Source: | TCP traffic: | ||
Source: | TCP traffic: |
Source: | HTTP traffic detected: |