popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

ottwsttuw.exe

AsyncRAT Generic Malware PWS PE File OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 24, 2021, 10:57 p.m. June 24, 2021, 11:13 p.m.
Size 210.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 5be8cfbec412b84cad8de61c090843c3
SHA256 0d26a725dfe84f25ef37d6a667e37359638442d3ffba4b280850a39cc4d8cf14
CRC32 76D61359
ssdeep 6144:7PMK34rGiSi4kB3DBbZUdxG2hwdN4bgUvhLNGSMcE:7EKinSi53rUdxG2hwdN4bgUvhLNGSMcE
Yara
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section `\x7fn`LCP_
section
section {u'size_of_data': u'0x00012c00', u'virtual_address': u'0x00002000', u'entropy': 7.997952436295001, u'name': u'`\\x7fn`LCP_', u'virtual_size': u'0x00012bb8'} entropy 7.9979524363 description A section with a high entropy has been found
entropy 0.358851674641 description Overall entropy of this PE file is high
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Ransom.Jigsaw.10
FireEye Generic.mg.5be8cfbec412b84c
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
Cybereason malicious.ec412b
BitDefenderTheta Gen:NN.ZemsilF.34758.nu0@aemAPOg
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/Agent.DHI
APEX Malicious
Avast Win32:Evo-gen [Susp]
Kaspersky HEUR:Backdoor.MSIL.Crysan.gen
BitDefender Gen:Variant.Ransom.Jigsaw.10
Ad-Aware Gen:Variant.Ransom.Jigsaw.10
Sophos Generic ML PUA (PUA)
Emsisoft Gen:Variant.Ransom.Jigsaw.10 (B)
Ikarus Trojan.MSIL.Agent
eGambit Unsafe.AI_Score_99%
Avira HEUR/AGEN.1121272
Microsoft Trojan:MSIL/Ursu.KP
Gridinsoft Trojan.Heur!.03013281
Arcabit Trojan.Ransom.Jigsaw.10
GData Gen:Variant.Ransom.Jigsaw.10
Cynet Malicious (score: 100)
VBA32 CIL.HeapOverride.Heur
ALYac Gen:Variant.Ransom.Jigsaw.10
MAX malware (ai score=84)
Malwarebytes Trojan.Crypt.MSIL
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
AVG Win32:Evo-gen [Susp]
CrowdStrike win/malicious_confidence_100% (D)