Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	April 28, 2025, 10:12 a.m.	April 28, 2025, 10:20 a.m.

Size	124.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`2a2a154e8cfb9c8393b610632f49c5cb`
SHA256	`58b9a714f452315a599d2514074da44e700850f79add468742a77acca0cd080c`
CRC32	`4979DE18`
ssdeep	`3072:34Z27UeZm+wr7CImXEGP/Y4Z3SNq/ofYYOpf:oo7JfuCIAEG/Z38Ynpf`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) Win_Amadey_Zero - Amadey bot Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
2132
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,Main
2220
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
1648
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,
2312

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.39.17.163	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 28, 2025, 10:12 a.m.			0	0
IsDebuggerPresent April 28, 2025, 10:12 a.m.			0	0
IsDebuggerPresent April 28, 2025, 10:12 a.m.			0	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header, Connection to IP address

suspicious_request

POST http://185.39.17.163/Su8kud7i/index.php

Performs some HTTP requests (1 event)

request

POST http://185.39.17.163/Su8kud7i/index.php

Sends data using the HTTP POST Method (1 event)

request

POST http://185.39.17.163/Su8kud7i/index.php

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 28, 2025, 10:12 a.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744c6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:12 a.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:12 a.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:12 a.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:12 a.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74440000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:12 a.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:12 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744c6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:12 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:12 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:12 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:12 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74440000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:12 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:12 a.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744c6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:12 a.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:12 a.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:12 a.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:12 a.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743c0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:12 a.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74491000 process_handle: 0xffffffff	1

Communicates with host for which no DNS query was performed (1 event)

host

185.39.17.163

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 events)

Bkav	W32.AIDetectMalware
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojanpws.Kliper
ALYac	Gen:Variant.Zusy.446682
Cylance	Unsafe
VIPRE	Gen:Variant.Zusy.446682
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Zusy.446682
K7GW	Trojan ( 005b155f1 )
K7AntiVirus	Trojan ( 005b155f1 )
Arcabit	Trojan.Zusy.D6D0DA
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/ClipBanker.SJ
Avast	Win32:MalwareX-gen [Trj]
ClamAV	Win.Malware.Zusy-10015683-0
Kaspersky	UDS:DangerousObject.Multi.Generic
Alibaba	TrojanPSW:Win32/Amadey.b162328b
NANO-Antivirus	Trojan.Win32.Kliper.kwarug
MicroWorld-eScan	Gen:Variant.Zusy.446682
Rising	Downloader.Amadey!1.1275B (CLASSIC)
Emsisoft	Gen:Variant.Zusy.446682 (B)
F-Secure	Trojan.TR/ClipBanker.vdzay
Zillya	Trojan.ClipBanker.Win32.24647
TrendMicro	Trojan.Win32.AMADEY.YXFDWZ
McAfeeD	ti!58B9A714F452
CTX	dll.trojan.clipbanker
Sophos	Troj/Amadey-Gen
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/ClipBanker.vdzay
Antiy-AVL	Trojan/Win32.Amadey
Gridinsoft	Ransom.Win32.Banker.sa
Microsoft	Trojan:Win32/Amadey.MA!MTB
ViRobot	Trojan.Win.Z.Clipbanker.126976.N
ZoneAlarm	Troj/Amadey-Gen
GData	Win32.Trojan-Stealer.Amadey.F
Varist	W32/ABTrojan.CTSC-7643
AhnLab-V3	Trojan/Win.Amadey.C5684740
McAfee	Artemis!2A2A154E8CFB
DeepInstinct	MALICIOUS
VBA32	TrojanPSW.Kliper
Malwarebytes	Trojan.ClipBanker
Ikarus	Trojan.Win32.Clipbanker
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Trojan.Win32.AMADEY.YXFDWZ
Tencent	Malware.Win32.Gencirc.143ff755
Yandex	Trojan.ClipBanker!Xuh6/PByFRY
huorong	TrojanSpy/ClipBanker.y

clip64.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All