popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

xmrig.exe

Generic Malware Malicious Library UPX Malicious Packer PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 18, 2021, 2:28 p.m. Nov. 18, 2021, 2:31 p.m.
Size 6.9MB
Type PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
MD5 a7168bd94f951899e8a37523bde461dc
SHA256 c1f09c6ca6c683e1605edd5f9c3b3cc9b9524d60d2bd961647c959f17593a1d5
CRC32 4B348177
ssdeep 98304:97aSPTPO39rMCEIrcMGmMETseyxFhQz9Uy4fWrlkhS3UPxdzwsur0+pvPCbkb9jV:9ZXQls0qqb9KiWsZSonf
Yara
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE64 - (no description)
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2792
region_size: 131072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000f10000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0
Lionic Riskware.Win32.BitMiner.1!c
Elastic malicious (high confidence)
DrWeb Tool.BtcMine.2548
MicroWorld-eScan Gen:Variant.Application.Miner.2
FireEye Generic.mg.a7168bd94f951899
ALYac Gen:Variant.Application.Miner.2
Malwarebytes RiskWare.BitCoinMiner
Zillya Trojan.Miner.Win32.12658
CrowdStrike win/malicious_confidence_60% (D)
Alibaba Trojan:Win64/Miners.030a8a8c
K7GW Riskware ( 005622c31 )
K7AntiVirus Riskware ( 005622c31 )
Arcabit Trojan.Application.Miner.2
Cyren W64/Coinminer.BN.gen!Eldorado
Symantec Trojan.Gen.MBT
ESET-NOD32 a variant of Win64/CoinMiner.PO potentially unwanted
TrendMicro-HouseCall Coinminer.Win64.MALXMR.SMA
Paloalto generic.ml
ClamAV Win.Coinminer.Generic-7151250-0
Kaspersky not-a-virus:HEUR:RiskTool.Win32.BitMiner.gen
BitDefender Gen:Variant.Application.Miner.2
NANO-Antivirus Trojan.Win64.Miner.iunnja
Avast Win64:CoinminerX-gen [Trj]
Ad-Aware Gen:Variant.Application.Miner.2
Emsisoft Gen:Variant.Application.Miner.2 (B)
Comodo ApplicUnwnt@#21ohdyzym9x3e
F-Secure PotentialRisk.PUA/CoinMiner.GY
VIPRE Trojan.Win32.Generic!BT
TrendMicro Coinminer.Win64.MALXMR.SMA
McAfee-GW-Edition BehavesLike.Win64.Dropper.vh
Sophos XMRig Miner (PUA)
Ikarus PUA.CoinMiner
Jiangmin RiskTool.BitMiner.cert
Avira PUA/CoinMiner.GY
Antiy-AVL RiskWare[RiskTool]/Win32.BitMiner
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Trojan.Win64.CoinMiner.vb
GData Win32.Application.CoinMiner.Y
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win64.XMR-Miner.R226842
Acronis suspicious
McAfee GenericRXAA-AA!A7168BD94F95
MAX malware (ai score=75)
VBA32 Trojan.Miner
Cylance Unsafe
APEX Malicious
Rising HackTool.XMRMiner!1.C2EC (CLASSIC)
Yandex Trojan.Miner!WXe9ik6To6g
SentinelOne Static AI - Malicious PE
Fortinet W64/CoinMiner.PO!tr