Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 24, 2021, 7:30 p.m.	June 24, 2021, 8:18 p.m.

Size	72.1KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`708c8a452d02d46ed6a1c16486a7a206`
SHA256	`324608df5cf59ab5c698f0116938e4073a8fd5ea406eadbc43c890fa160bd601`
CRC32	`FAEA2DBD`
ssdeep	`1536:ILzFbDy9rarrxSuEQ9DaYy1Eg71MDMb+KR0Nc8QsJq39:Y1yFarrEuCYl9De0Nc8QsC9`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch
47.107.79.90	Active	Moloch

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 24, 2021, 7:30 p.m.	process_identifier: 3972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00300000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

section

{u'size_of_data': u'0x0000b000', u'virtual_address': u'0x00001000', u'entropy': 7.016666654722094, u'name': u'.text', u'virtual_size': u'0x0000a966'}

entropy

7.01666665472

description

A section with a high entropy has been found

entropy

0.647058823529

description

Overall entropy of this PE file is high

host	172.217.25.14
host	47.107.79.90

Bkav	W32.FamVT.RorenNHc.Trojan
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.CryptZ.Gen
FireEye	Generic.mg.708c8a452d02d46e
CAT-QuickHeal	Trojan.Swrort.A
ALYac	Trojan.CryptZ.Gen
Cylance	Unsafe
SUPERAntiSpyware	Trojan.Backdoor-Shell
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 004c49f81 )
K7GW	Trojan ( 004c49f81 )
Cybereason	malicious.52d02d
BitDefenderTheta	Gen:NN.ZexaF.34758.eq1@aG9ltBki
Cyren	W32/Swrort.A.gen!Eldorado
Symantec	Packed.Generic.347
ESET-NOD32	a variant of Win32/Rozena.ZL
APEX	Malicious
Avast	Win32:SwPatch [Wrm]
ClamAV	Win.Trojan.Swrort-5710536-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.CryptZ.Gen
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
ViRobot	Trojan.Win32.Elzob.Gen
Ad-Aware	Trojan.CryptZ.Gen
Emsisoft	Trojan.CryptZ.Gen (B)
Comodo	TrojWare.Win32.Rozena.A@4jwdqr
TrendMicro	Backdoor.Win32.SWRORT.SMAL01
McAfee-GW-Edition	BehavesLike.Win32.Swrort.lh
Sophos	ML/PE-A + ATK/EncPk-TZ
Ikarus	Trojan.Win32.Swrort
eGambit	Unsafe.AI_Score_99%
Avira	TR/Patched.Gen2
MAX	malware (ai score=82)
Microsoft	Trojan:Win32/Meterpreter.O
Gridinsoft	Trojan.Win32.Swrort.zv!s2
Arcabit	Trojan.CryptZ.Gen
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Trojan.CryptZ.Gen
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Shell.R1283
Acronis	suspicious
McAfee	Swrort.i
Malwarebytes	Trojan.Rozena
TrendMicro-HouseCall	Backdoor.Win32.SWRORT.SMAL01
Rising	Malware.Heuristic!ET#100% (RDMK:cmRtazqkIN7MzmWs/cswq3VXl6Wr)
Yandex	Trojan.Rosena.Gen.1
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MalwThreat!df3bIV
Webroot	W32.Malware.Gen

shell.exe