popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

xmrig.exe

Generic Malware Malicious Library UPX Malicious Packer PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 25, 2023, 8:05 a.m. April 25, 2023, 8:07 a.m.
Size 7.9MB
Type PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
MD5 c0ed4f906576c06d861302e8cf924309
SHA256 8e1c569508baacd7803f80728c03ed1d6ab098a1576c6470420e7a3af84c489c
CRC32 AF32FBD9
ssdeep 98304:aSsvsg5c2f0ghoi/OVShca+XZ9FfdZwUtbpvsXMcOGR0tFC8JiMig5RbLJitOkL4:FY0gqbjViicOF5eAeEPHRs81GeJ7
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE64 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 131072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000001db0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0
Lionic Riskware.Win32.BitCoinMiner.1!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.66489569
ClamAV Win.Coinminer.Generic-7151250-0
FireEye Generic.mg.c0ed4f906576c06d
CAT-QuickHeal Trojan.CoinMiner
McAfee W64/CoinMiner!C0ED4F906576
Malwarebytes BitcoinMiner.Trojan.Miner.DDS
Zillya Trojan.CoinMiner.Win64.9618
Sangfor Trojan.Win64.XMR.Miner
K7AntiVirus Riskware ( 005622c31 )
Alibaba RiskWare:Win64/Miners.9d7489ff
K7GW Riskware ( 005622c31 )
Arcabit Trojan.Generic.D3F68CE1
Cyren W64/Coinminer.BN.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win64/CoinMiner.IZ potentially unwanted
Paloalto generic.ml
Cynet Malicious (score: 100)
Kaspersky not-a-virus:HEUR:RiskTool.Win32.BitCoinMiner.gen
BitDefender Trojan.GenericKD.66489569
Avast Win64:CoinminerX-gen [Trj]
Tencent Risktool.Win64.Bitminer.16000063
Sophos XMRig Miner (PUA)
VIPRE Trojan.GenericKD.66489569
TrendMicro TROJ_GEN.R002C0PD323
McAfee-GW-Edition W64/CoinMiner!C0ED4F906576
Emsisoft Trojan.GenericKD.66489569 (B)
SentinelOne Static AI - Suspicious PE
Webroot Bitcoinminer.Gen
Antiy-AVL Trojan[Miner]/Win64.Xmrig.gen
Gridinsoft Trojan.Win64.Gen.bot
Xcitium Malware@#2ahi7jg1unuh2
ZoneAlarm not-a-virus:HEUR:RiskTool.Win32.BitCoinMiner.gen
GData Win32.Application.CoinMiner.Y
Google Detected
Acronis suspicious
ALYac Trojan.GenericKD.66489569
MAX malware (ai score=80)
Cylance unsafe
Panda Trj/CI.A
TrendMicro-HouseCall TROJ_GEN.R002C0PD323
Rising HackTool.XMRMiner!1.C2EC (CLASSIC)
Yandex Riskware.Agent!ZOVmQo6/xUA
Ikarus PUA.CoinMiner
MaxSecure Trojan.Malware.121218.susgen
Fortinet Riskware/CoinMiner.PO
AVG Win64:CoinminerX-gen [Trj]
DeepInstinct MALICIOUS