popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

kcudinre.exe

AsyncRAT Generic Malware PWS PE File OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 24, 2021, 10:57 p.m. June 24, 2021, 11:11 p.m.
Size 210.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 777d71c05d2f06f0c170d21912003808
SHA256 64b4160b8fb19bba843ecc9dd74c6c74a34b2ee37c12e9afaf0c4693bd9b8e7c
CRC32 512E6331
ssdeep 6144:7MRiA4tbz+mjaOpk0PBeDbRKLOkrOY6qpm+AXzpwBYiFh0x3:bVtzjaOp1EZKLOkrOY6qpm+AXzpwBYiy
Yara
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section \x19\x16+Ab\x0b!w
section
section {u'size_of_data': u'0x00012c00', u'virtual_address': u'0x00002000', u'entropy': 7.997425059003576, u'name': u'\\x19\\x16+Ab\\x0b!w', u'virtual_size': u'0x00012bb8'} entropy 7.997425059 description A section with a high entropy has been found
entropy 0.35799522673 description Overall entropy of this PE file is high
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Ransom.Jigsaw.10
FireEye Generic.mg.777d71c05d2f06f0
McAfee Artemis!777D71C05D2F
Malwarebytes Trojan.Crypt.MSIL
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (D)
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/Agent.DHI
APEX Malicious
Avast Win32:Malware-gen
Kaspersky HEUR:Backdoor.MSIL.Crysan.gen
BitDefender Gen:Variant.Ransom.Jigsaw.10
Tencent Win32.Trojan.Ransom.Ahyr
Ad-Aware Gen:Variant.Ransom.Jigsaw.10
Emsisoft Gen:Variant.Ransom.Jigsaw.10 (B)
DrWeb Trojan.MulDrop17.54342
TrendMicro TROJ_GEN.R06CC0DFM21
McAfee-GW-Edition BehavesLike.Win32.Generic.dh
Sophos Generic ML PUA (PUA)
Ikarus Trojan.MSIL.Agent
MaxSecure Trojan.Malware.300983.susgen
Avira HEUR/AGEN.1121272
Antiy-AVL Trojan/Generic.ASMalwS.3394D51
Kingsoft Win32.Heur.KVMH008.a.(kcloud)
Gridinsoft Trojan.Heur!.03013281
Microsoft Trojan:MSIL/Ursu.KP
GData Gen:Variant.Ransom.Jigsaw.10
Cynet Malicious (score: 100)
BitDefenderTheta Gen:NN.ZemsilF.34758.nu0@amY46x
ALYac Gen:Variant.Ransom.Jigsaw.10
MAX malware (ai score=87)
VBA32 CIL.HeapOverride.Heur
Cylance Unsafe
TrendMicro-HouseCall TROJ_GEN.R06CC0DFM21
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_99%
Fortinet W32/Crysan.DHI!tr.bdr
AVG Win32:Malware-gen
Cybereason malicious.05d2f0