Summary | ZeroBOX

ottwsttuw.exe

AsyncRAT Generic Malware PWS PE File OS Processor Check PE32 .NET EXE
Category Machine Started Completed
FILE s1_win7_x6401 June 24, 2021, 10:57 p.m. June 24, 2021, 11:13 p.m.
Size 210.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 5be8cfbec412b84cad8de61c090843c3
SHA256 0d26a725dfe84f25ef37d6a667e37359638442d3ffba4b280850a39cc4d8cf14
CRC32 76D61359
ssdeep 6144:7PMK34rGiSi4kB3DBbZUdxG2hwdN4bgUvhLNGSMcE:7EKinSi53rUdxG2hwdN4bgUvhLNGSMcE
Yara
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section `\x7fn`LCP_
section
section {u'size_of_data': u'0x00012c00', u'virtual_address': u'0x00002000', u'entropy': 7.997952436295001, u'name': u'`\\x7fn`LCP_', u'virtual_size': u'0x00012bb8'} entropy 7.9979524363 description A section with a high entropy has been found
entropy 0.358851674641 description Overall entropy of this PE file is high
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Ransom.Jigsaw.10
FireEye Generic.mg.5be8cfbec412b84c
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
Cybereason malicious.ec412b
BitDefenderTheta Gen:NN.ZemsilF.34758.nu0@aemAPOg
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/Agent.DHI
APEX Malicious
Avast Win32:Evo-gen [Susp]
Kaspersky HEUR:Backdoor.MSIL.Crysan.gen
BitDefender Gen:Variant.Ransom.Jigsaw.10
Ad-Aware Gen:Variant.Ransom.Jigsaw.10
Sophos Generic ML PUA (PUA)
Emsisoft Gen:Variant.Ransom.Jigsaw.10 (B)
Ikarus Trojan.MSIL.Agent
eGambit Unsafe.AI_Score_99%
Avira HEUR/AGEN.1121272
Microsoft Trojan:MSIL/Ursu.KP
Gridinsoft Trojan.Heur!.03013281
Arcabit Trojan.Ransom.Jigsaw.10
GData Gen:Variant.Ransom.Jigsaw.10
Cynet Malicious (score: 100)
VBA32 CIL.HeapOverride.Heur
ALYac Gen:Variant.Ransom.Jigsaw.10
MAX malware (ai score=84)
Malwarebytes Trojan.Crypt.MSIL
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
AVG Win32:Evo-gen [Susp]
CrowdStrike win/malicious_confidence_100% (D)