Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 16, 2023, 7:29 a.m.	June 16, 2023, 7:31 a.m.

Size	2.0MB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`863359773158308ac17b5340a3b76242`
SHA256	`e80c9b5cada25f7888b69a93fd8ecc8f887b8f399abe0641c4c4f97c3a526db9`
CRC32	`9D3FA8E2`
ssdeep	`49152:OoGin4osB4YAvR0hvKg3oNG/lgLVqwBmBSnwyCKJmmBp6e:OViXv+hvKmoBBmBktCZmBpR`
Yara	Malicious_Library_Zero - Malicious_Library IsPE64 - (no description) PE_Header_Zero - PE File Signature

Name	Response	Post-Analysis Lookup
accept-file.com	A 45.32.146.65	45.32.146.65
xmr.2miners.com	A 162.19.139.184	162.19.139.184

Flow	SID	Signature	Category
TCP 192.168.56.103:49162 -> 162.19.139.184:2222	2024792	ET POLICY Cryptocurrency Miner Checkin	Potential Corporate Privacy Violation
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2040353	ET COINMINER Observed DNS Query to Cryptocurrency Mining Pool Domain (xmr .2miners .com)	Crypto Currency Mining Activity Detected
TCP 192.168.56.103:49163 -> 45.32.146.65:80	2011341	ET HUNTING Suspicious POST With Reference to WINDOWS Folder Possible Malware Infection	A Network Trojan was detected
TCP 192.168.56.103:49163 -> 45.32.146.65:80	2035420	ET MALWARE Win32/Pripyat Activity (POST)	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 45.32.146.65:80	2011341	ET HUNTING Suspicious POST With Reference to WINDOWS Folder Possible Malware Infection	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 45.32.146.65:80	2035420	ET MALWARE Win32/Pripyat Activity (POST)	A Network Trojan was detected
TCP 192.168.56.103:49162 -> 162.19.139.184:2222	2024792	ET POLICY Cryptocurrency Miner Checkin	Potential Corporate Privacy Violation

No Suricata TLS

suspicious_features

POST method with no referer header

suspicious_request

POST http://accept-file.com/dashboard/para/un/api/endpoint.php

request

POST http://accept-file.com/dashboard/para/un/api/endpoint.php

request

POST http://accept-file.com/dashboard/para/un/api/endpoint.php

section

{u'size_of_data': u'0x001fbc00', u'virtual_address': u'0x0000c000', u'entropy': 7.964984684579491, u'name': u'.data', u'virtual_size': u'0x001fbb60'}

entropy

7.96498468458

description

A section with a high entropy has been found

entropy

0.973167225683

description

Overall entropy of this PE file is high

Elastic	malicious (high confidence)
FireEye	Generic.mg.863359773158308a
Malwarebytes	Generic.Trojan.Malpack.DDS
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0059d3f31 )
K7GW	Trojan ( 0059d3f31 )
Cybereason	malicious.6827d7
Symantec	ML.Attribute.HighConfidence
Cynet	Malicious (score: 100)
APEX	Malicious
F-Secure	Trojan.TR/Crypt.EPACK.Gen2
McAfee-GW-Edition	BehavesLike.Win64.Sality.vc
Sophos	Troj/Miner-AFR
Avira	TR/Crypt.EPACK.Gen2
Microsoft	Trojan:Win64/CoinMiner.ES!MTB
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R534006
McAfee	Artemis!863359773158
Tencent	Win32.Trojan.Miner.Usmw
Ikarus	Trojan.Win64.CoinMiner
Fortinet	W64/Agent.AGENMM!tr
CrowdStrike	win/malicious_confidence_70% (D)

Srveises.exe