popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

lidsjeswbm.exe

AsyncRAT Generic Malware PWS PE File OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 June 24, 2021, 10:56 p.m. June 24, 2021, 11:13 p.m.
Size 210.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 e10349eeda1868b711ec624cd462e386
SHA256 60d238941d065dd5a8785ebce4cb04d649d63005853dec359ca57674599a630d
CRC32 D2438F9D
ssdeep 6144:1LHT0BZnDV3ku9cszFTT+of03bKA1fjP1aSze+sa0KHrQKUL1hTvzyUU:1LInDuH2A1fjP1aSze+sa0KHrQKUL1hw
Yara
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
172.217.25.14 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section 11Tr\x0bPA{
section
section {u'size_of_data': u'0x00012c00', u'virtual_address': u'0x00002000', u'entropy': 7.9980206431407215, u'name': u'11Tr\\x0bPA{', u'virtual_size': u'0x00012a6c'} entropy 7.99802064314 description A section with a high entropy has been found
entropy 0.358851674641 description Overall entropy of this PE file is high
host 172.217.25.14
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Ransom.Jigsaw.10
FireEye Generic.mg.e10349eeda1868b7
ALYac Gen:Variant.Ransom.Jigsaw.10
Malwarebytes Trojan.Crypt.MSIL
Sangfor Trojan.Win32.Save.a
BitDefender Gen:Variant.Ransom.Jigsaw.10
Cybereason malicious.eda186
BitDefenderTheta Gen:NN.ZemsilF.34758.nu0@a8P343n
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/Agent.DHI
APEX Malicious
Kaspersky HEUR:Backdoor.MSIL.Crysan.gen
Ad-Aware Gen:Variant.Ransom.Jigsaw.10
TrendMicro TROJ_GEN.R06CC0DFL21
Emsisoft Gen:Variant.Ransom.Jigsaw.10 (B)
Ikarus Trojan.MSIL.Agent
GData Gen:Variant.Ransom.Jigsaw.10
Avira HEUR/AGEN.1121272
Gridinsoft Trojan.Heur!.03013281
Arcabit Trojan.Ransom.Jigsaw.10
Microsoft Trojan:MSIL/Ursu.KP
Cynet Malicious (score: 100)
MAX malware (ai score=89)
VBA32 CIL.HeapOverride.Heur
TrendMicro-HouseCall TROJ_GEN.R06CC0DFL21
Tencent Win32.Trojan.Ransom.Afqp
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
AVG FileRepMalware
Avast FileRepMalware
CrowdStrike win/malicious_confidence_100% (D)