popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

xmrig.exe

Generic Malware UPX Malicious Library Malicious Packer PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 21, 2023, 12:23 p.m. June 21, 2023, 12:25 p.m.
Size 7.9MB
Type PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
MD5 0b021b93052fed386a4d094edae61ca8
SHA256 0510f1e57b0bc5967a8b658cea729948219d578b6c9b3a036ff33b4a6a46e495
CRC32 E906DE07
ssdeep 98304:1qEqoiuD0Sl7r5qCEShFa+XWgUyeC6SmIaAgXMQ3AyCQRy1/ANwCZJu3ThnklTmn:bkSl7L7ztTLblSwNgIxlstyZI5Hd
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • IsPE64 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 131072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000510000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0
Lionic Trojan.Win32.Convagent.4!c
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
FireEye Generic.mg.0b021b93052fed38
McAfee W64/CoinMiner!0B021B93052F
Malwarebytes Neshta.Virus.FileInfector.DDS
VIPRE Gen:Variant.Application.Miner.2
Sangfor Trojan.Win64.XMR.Miner
K7AntiVirus Riskware ( 005622c31 )
Alibaba RiskWare:Win64/Miners.fa03bffc
K7GW Riskware ( 005622c31 )
CrowdStrike win/grayware_confidence_100% (W)
Arcabit Trojan.Application.Miner.2
Cyren W64/Coinminer.BN.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win64/CoinMiner.IZ potentially unwanted
ClamAV Win.Coinminer.Generic-7151250-0
Kaspersky not-a-virus:HEUR:RiskTool.Win32.BitCoinMiner.gen
BitDefender Gen:Variant.Application.Miner.2
NANO-Antivirus Trojan.Win64.CoinMiner.juvfrc
MicroWorld-eScan Gen:Variant.Application.Miner.2
Avast Win64:CoinminerX-gen [Trj]
Tencent Risktool.Win64.Bitminer.16000063
Emsisoft Gen:Variant.Application.Miner.2 (B)
DrWeb Trojan.BtcMine.3725
Zillya Tool.BitCoinMiner.Win32.41988
TrendMicro TROJ_GEN.R002C0PB323
McAfee-GW-Edition BehavesLike.Win64.Dropper.wh
Sophos XMRig Miner (PUA)
Ikarus PUA.CoinMiner
Jiangmin RiskTool.BitCoinMiner.atsq
Webroot Bitcoinminer.Gen
Antiy-AVL Trojan[Miner]/Win64.Xmrig.gen
Gridinsoft Trojan.Win64.CoinMiner.ca
Xcitium ApplicUnwnt@#otsuqsw372wl
ZoneAlarm not-a-virus:HEUR:RiskTool.Win32.BitCoinMiner.gen
GData Win32.Application.CoinMiner.Y
Google Detected
AhnLab-V3 Unwanted/Win.BitMiner.R559418
Acronis suspicious
ALYac Gen:Variant.Application.Miner.2
MAX malware (ai score=76)
Cylance unsafe
Panda Trj/CI.A
TrendMicro-HouseCall TROJ_GEN.R002C0PB323
Rising HackTool.XMRMiner!1.C2EC (CLASSIC)
Yandex Riskware.Agent!L4+xPzTwgrk
SentinelOne Static AI - Suspicious PE
MaxSecure Trojan.Malware.121218.susgen
Fortinet Riskware/CoinMiner.PO