ScreenShot
| Created | 2025.05.01 10:02 | Machine | s1_win7_x6403 |
| Filename | XPT.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 45 detected (AIDetectMalware, Ghanarava, Jaik, Unsafe, Vk6s, malicious, confidence, Attribute, HighConfidence, moderate confidence, a variant of Generik, LMPLFRZ, Zegost, CLOUD, 0NA103FH23, high, score, Static AI, Suspicious PE, Detected, Wacapew, ABTrojan, THFI, CoinMiner, R374645, GenericRXAA, TScope, Delf, FraudLoa, Chgt, susgen, PossibleThreat, Software, Wacatac, B9nj) | ||
| md5 | bd551fb89a9dbd192717d3dabe8dc902 | ||
| sha256 | 9b93677dfa0fef47373d7739910a3b355dc54aa43dabe4bf8a8dc7f97a54acb1 | ||
| ssdeep | 12288:LIurv8NX666cIUvXUh8TdRvdtRVTjnjU4tJqq/PNdFKA519NdE9CLDJjXA3qpwHS:LI+C69Kku5RXvjU4RNdFKAjdE4LRA3qt | ||
| imphash | e253f8ec0371c0d6a5b2b4676e8c61c6 | ||
| impfuzzy | 3:oTEKCROXCHLqRKQRElAWBJAEPw1MO/OywS9KTXzhAXwEQaxREJdqMEldVu2bW6LG:omRgCH7BJAEoZ/OEGDzyRg3E7s2btyBB | ||
Network IP location
Signature (9cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 45 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Creates executable files on the filesystem |
| notice | Drops a binary and executes it |
| notice | Drops an executable to the user AppData folder |
| notice | Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | The executable is compressed using UPX |
| info | Checks amount of memory in system |
Rules (10cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | ASProtect_Zero | ASProtect packed file | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | mzp_file_format | MZP(Delphi) file format | binaries (download) |
| info | mzp_file_format | MZP(Delphi) file format | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
advapi32.dll
0xe31184 RegCloseKey
gdi32.dll
0xe3118c TextOutA
KERNEL32.DLL
0xe31194 LoadLibraryA
0xe31198 ExitProcess
0xe3119c GetProcAddress
0xe311a0 VirtualProtect
oleaut32.dll
0xe311a8 VariantCopy
shell32.dll
0xe311b0 ShellExecuteA
user32.dll
0xe311b8 EndPaint
EAT(Export Address Table) is none
advapi32.dll
0xe31184 RegCloseKey
gdi32.dll
0xe3118c TextOutA
KERNEL32.DLL
0xe31194 LoadLibraryA
0xe31198 ExitProcess
0xe3119c GetProcAddress
0xe311a0 VirtualProtect
oleaut32.dll
0xe311a8 VariantCopy
shell32.dll
0xe311b0 ShellExecuteA
user32.dll
0xe311b8 EndPaint
EAT(Export Address Table) is none