Summary
0b9ca6fb32fcde1e6e55e8874982a2a921e73c6ebdf7246177fecf63542a4a83
File 0b9ca6fb32fcde1e6e55e8874982a2a921e73c6ebdf7246177fecf63542a4a83
Summary
| Size | 148.0KB |
|---|---|
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 7712d05c8b499fc7a1f4a6a6b6dee825 |
| SHA1 | 57c50ca6fd6356218541dd27bee4dd0595ade842 |
| SHA256 | 0b9ca6fb32fcde1e6e55e8874982a2a921e73c6ebdf7246177fecf63542a4a83 |
| SHA512 |
721b967e4c10bdcc9cf36c97490835e972621e1f05cccf8b619dedb964efac352f10396bd91bbe0c544cfdfdf6e13d327dac01e5633658acff0b4e3f85ae7cbe
|
| CRC32 | 926CFF01 |
| ssdeep | None |
| Yara |
|
Score
This file is very suspicious, with a score of 10 out of 10!
Please notice: The scoring system is currently still in development and should be considered an alpha feature.
Feedback
Expecting different results? Send us this analysis and we will inspect it. Click here
Information on Execution
Analysis
| Category | Started | Completed | Duration | Routing | Logs |
|---|---|---|---|---|---|
| FILE | April 13, 2024, 1:23 p.m. | April 13, 2024, 1:24 p.m. | 43 seconds | internet |
Show Analyzer Log Show Cuckoo Log |
Analyzer Log
2024-04-13 12:42:51,015 [analyzer] DEBUG: Starting analyzer from: C:\tmp1xmcit 2024-04-13 12:42:51,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\limnERaWqtqBhRXglvwWSKovbMA 2024-04-13 12:42:51,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\KYaGfRFcHGyTqDmxXAqePkKauMnSmt 2024-04-13 12:42:51,250 [analyzer] DEBUG: Started auxiliary module Curtain 2024-04-13 12:42:51,250 [analyzer] DEBUG: Started auxiliary module DbgView 2024-04-13 12:42:51,655 [analyzer] DEBUG: Started auxiliary module Disguise 2024-04-13 12:42:51,858 [analyzer] DEBUG: Loaded monitor into process with pid 508 2024-04-13 12:42:51,858 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets 2024-04-13 12:42:51,858 [analyzer] DEBUG: Started auxiliary module Human 2024-04-13 12:42:51,858 [analyzer] DEBUG: Started auxiliary module InstallCertificate 2024-04-13 12:42:51,858 [analyzer] DEBUG: Started auxiliary module Reboot 2024-04-13 12:42:51,937 [analyzer] DEBUG: Started auxiliary module RecentFiles 2024-04-13 12:42:51,937 [analyzer] DEBUG: Started auxiliary module Screenshots 2024-04-13 12:42:51,937 [analyzer] DEBUG: Started auxiliary module Sysmon 2024-04-13 12:42:51,937 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n 2024-04-13 12:42:52,108 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\0b9ca6fb32fcde1e6e55e8874982a2a921e73c6ebdf7246177fecf63542a4a83.exe' with arguments '' and pid 1308 2024-04-13 12:42:52,296 [analyzer] DEBUG: Loaded monitor into process with pid 1308 2024-04-13 12:42:52,390 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 1308. 2024-04-13 12:42:53,108 [analyzer] INFO: Process with pid 1308 has terminated 2024-04-13 12:42:53,108 [analyzer] INFO: Process list is empty, terminating analysis. 2024-04-13 12:42:54,328 [analyzer] INFO: Terminating remaining processes before shutdown. 2024-04-13 12:42:54,328 [analyzer] INFO: Analysis completed.
Cuckoo Log
2024-04-13 13:23:45,988 [cuckoo.core.scheduler] INFO: Task #4663445: acquired machine win7x6414 (label=win7x6414) 2024-04-13 13:23:45,988 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.214 for task #4663445 2024-04-13 13:23:46,340 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 613596 (interface=vboxnet0, host=192.168.168.214) 2024-04-13 13:23:46,673 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6414 2024-04-13 13:23:47,831 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6414 to vmcloak 2024-04-13 13:23:59,064 [cuckoo.core.guest] INFO: Starting analysis #4663445 on guest (id=win7x6414, ip=192.168.168.214) 2024-04-13 13:24:00,069 [cuckoo.core.guest] DEBUG: win7x6414: not ready yet 2024-04-13 13:24:05,092 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6414, ip=192.168.168.214) 2024-04-13 13:24:05,184 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6414, ip=192.168.168.214, monitor=latest, size=6660546) 2024-04-13 13:24:06,513 [cuckoo.core.resultserver] DEBUG: Task #4663445: live log analysis.log initialized. 2024-04-13 13:24:07,314 [cuckoo.core.resultserver] DEBUG: Task #4663445 is sending a BSON stream 2024-04-13 13:24:07,736 [cuckoo.core.resultserver] DEBUG: Task #4663445 is sending a BSON stream 2024-04-13 13:24:08,585 [cuckoo.core.resultserver] DEBUG: Task #4663445: File upload for 'shots/0001.jpg' 2024-04-13 13:24:08,616 [cuckoo.core.resultserver] DEBUG: Task #4663445 uploaded file length: 133495 2024-04-13 13:24:09,732 [cuckoo.core.resultserver] DEBUG: Task #4663445: File upload for 'curtain/1713004974.2.curtain.log' 2024-04-13 13:24:09,735 [cuckoo.core.resultserver] DEBUG: Task #4663445 uploaded file length: 36 2024-04-13 13:24:09,844 [cuckoo.core.resultserver] DEBUG: Task #4663445: File upload for 'sysmon/1713004974.31.sysmon.xml' 2024-04-13 13:24:09,852 [cuckoo.core.resultserver] DEBUG: Task #4663445 uploaded file length: 116036 2024-04-13 13:24:10,720 [cuckoo.core.resultserver] DEBUG: Task #4663445 had connection reset for <Context for LOG> 2024-04-13 13:24:12,014 [cuckoo.core.guest] INFO: win7x6414: analysis completed successfully 2024-04-13 13:24:12,048 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks 2024-04-13 13:24:12,219 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer 2024-04-13 13:24:13,311 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6414 to path /srv/cuckoo/cwd/storage/analyses/4663445/memory.dmp 2024-04-13 13:24:13,313 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6414 2024-04-13 13:24:27,865 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.214 for task #4663445 2024-04-13 13:24:28,381 [cuckoo.core.scheduler] DEBUG: Released database task #4663445 2024-04-13 13:24:28,404 [cuckoo.core.scheduler] INFO: Task #4663445: analysis procedure completed
Signatures
| description | (no description) | rule | HACKSFASE2_APT1 | ||||||
| description | (no description) | rule | ccrewSSLBack1 | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Escalade priviledges | rule | escalate_priv | ||||||
| description | Affect system token | rule | win_token | ||||||
| description | Affect private profile | rule | win_files_operation | ||||||
| G Data Antivirus (Windows) | Virus: Gen:Variant.Fugrafa.98569 (Engine A) |
| Avast Core Security (Linux) | Win32:Malware-gen |
| C4S ClamAV (Linux) | Win.Trojan.Agent-30686 |
| F-Secure Antivirus (Linux) | Trojan.TR/Agent.151552.164 [Aquarius] |
| Windows Defender (Windows) | Trojan:Win32/Connapts |
| Microsoft Defender ATP (Linux) | Backdoor:Win32/Tartober.A |
| Sophos Anti-Virus (Linux) | Mal/Generic-R |
| eScan Antivirus (Linux) | Gen:Variant.Fugrafa.98569(DB) |
| ESET Security (Windows) | Win32/Agent.PMX trojan |
| DrWeb Antivirus (Linux) | Win32.HLLW.Autoruner1.19011 |
| ClamAV (Linux) | Win.Trojan.Agent-30686 |
| Bitdefender Antivirus (Linux) | Gen:Variant.Fugrafa.98569 |
| Kaspersky Standard (Windows) | UDS:Backdoor.Win32.Shady.d |
| Lionic | Trojan.Win32.Shady.m!c |
| Cynet | Malicious (score: 99) |
| McAfee | Artemis!7712D05C8B49 |
| ALYac | Gen:Variant.Fugrafa.98569 |
| Cylance | unsafe |
| VIPRE | Gen:Variant.Fugrafa.98569 |
| Sangfor | Trojan.Win32.Agent.PMX |
| K7AntiVirus | Trojan ( 0055e3dd1 ) |
| BitDefender | Gen:Variant.Fugrafa.98569 |
| K7GW | Trojan ( 0055e3dd1 ) |
| Cybereason | malicious.c8b499 |
| Arcabit | Trojan.Fugrafa.D18109 |
| VirIT | Backdoor.Win32.Generic.BMZF |
| Symantec | ML.Attribute.HighConfidence |
| ESET-NOD32 | Win32/Agent.PMX |
| APEX | Malicious |
| Avast | Win32:Malware-gen |
| ClamAV | Win.Trojan.Agent-30686 |
| Kaspersky | Backdoor.Win32.Shady.d |
| Alibaba | Malware:Win32/km_24a0e.None |
| NANO-Antivirus | Trojan.Win32.Shady.ucmgh |
| MicroWorld-eScan | Gen:Variant.Fugrafa.98569 |
| Rising | Backdoor.Shady!8.DB1D (TFE:5:hTMWxtKyOXN) |
| Emsisoft | Gen:Variant.Fugrafa.98569 (B) |
| F-Secure | Heuristic.HEUR/AGEN.1362094 |
| DrWeb | Win32.HLLW.Autoruner1.19011 |
| Zillya | Backdoor.Shady.Win32.1 |
| TrendMicro | BKDR_SHADY.B |
| McAfee-GW-Edition | BehavesLike.Win32.NetLoader.ch |
| FireEye | Gen:Variant.Fugrafa.98569 |
| Sophos | Mal/Generic-R |
| Ikarus | Backdoor.Win32.Shady |
| Jiangmin | Backdoor/Shady.b |
| Webroot | W32.Backdoor.Gen |
| Avira | HEUR/AGEN.1362094 |
| MAX | malware (ai score=100) |
| Antiy-AVL | Trojan[Backdoor]/Win32.Shady |
| Xcitium | Malware@#2vy4mnhtegbq |
| Microsoft | Trojan:Win32/Connapts |
| ViRobot | Trojan.Win32.S.Agent.151552.AA |
| ZoneAlarm | Backdoor.Win32.Shady.d |
| GData | Gen:Variant.Fugrafa.98569 |
| Detected | |
| BitDefenderTheta | Gen:NN.ZexaF.36250.jqW@aeBysNbi |
| TACHYON | Backdoor/W32.Shady.151552 |
| DeepInstinct | MALICIOUS |
| VBA32 | Backdoor.Shady |
| Malwarebytes | Malware.AI.334716129 |
| Panda | Trj/CI.A |
| TrendMicro-HouseCall | BKDR_SHADY.B |
Screenshots
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
| IP Address | Status | Action | VT | Location |
|---|---|---|---|---|
| No hosts contacted. | ||||
