Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 5, 2021, 4:50 p.m.	Sept. 5, 2021, 4:53 p.m.

Size	7.1MB
Type	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
MD5	`28fed6fd70691d410de60a57d590b549`
SHA256	`809e6103be38daf10dc04c9fbe476f0187a7558133361b83917982fbe24d3ade`
CRC32	`07C81262`
ssdeep	`98304:9/3vTXGjTPr9H3GYEIrcMGmMEGdbI8C2LUDI5T1sIMftBzYthfW8aB2+dXjpviF/:9Pr4KFMzG/FSViXsdLKSDai`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library Malicious_Packer_Zero - Malicious Packer

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Sept. 5, 2021, 4:43 p.m.	computer_name: TEST22-PC	1	1	0

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 5, 2021, 4:43 p.m.	process_identifier: 1868 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d30000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0	0

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Application.Miner.2
McAfee	W64/CoinMiner!28FED6FD7069
K7AntiVirus	Riskware ( 005622c31 )
K7GW	Riskware ( 005622c31 )
Cybereason	malicious.d70691
Arcabit	Trojan.Application.Miner.2
Cyren	W64/Coinminer.BN.gen!Eldorado
ESET-NOD32	a variant of Win64/CoinMiner.PO potentially unwanted
Paloalto	generic.ml
ClamAV	Win.Coinminer.Generic-7151250-0
Kaspersky	Trojan.Win32.Miner.axutb
BitDefender	Gen:Variant.Application.Miner.2
Avast	Win64:CoinminerX-gen [Trj]
Ad-Aware	Gen:Variant.Application.Miner.2
Sophos	XMRig Miner (PUA)
McAfee-GW-Edition	BehavesLike.Win64.Generic.wh
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.28fed6fd70691d41
Emsisoft	Gen:Variant.Application.Miner.2 (B)
APEX	Malicious
Avira	HEUR/AGEN.1136970
Gridinsoft	Risk.Win64.CoinMiner.sd!i
Microsoft	Program:Win32/Wacapew.C!ml
GData	Win32.Application.CoinMiner.Y
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win64.XMR-Miner.R226842
ALYac	Gen:Variant.Application.Miner.2
MAX	malware (ai score=77)
Malwarebytes	RiskWare.BitCoinMiner
Rising	HackTool.XMRMiner!1.C2EC (CLASSIC)
Ikarus	PUA.CoinMiner
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W64/CoinMiner.PO!tr
AVG	Win64:CoinminerX-gen [Trj]
CrowdStrike	win/malicious_confidence_80% (D)

redis-server.exe