Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 14, 2023, 9:41 a.m.	July 14, 2023, 9:43 a.m.

Size	9.8MB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`6d1b84686d5dd7d8b6d0ab310b5481d1`
SHA256	`c5ffcc379272858774a19b9d43122e1ec4b23154c5721b7d8975dd7783f3c636`
CRC32	`F8ACD37F`
ssdeep	`196608:dFgA7mLzVoOUJ071rCohiKyjDl9E1V8D7tB9AShx:dFgA7mLzqJ071rCo+eVq7tBbhx`
Yara	IsPE64 - (no description) PE_Header_Zero - PE File Signature

Name	Response	Post-Analysis Lookup
xmr.2miners.com	A 162.19.139.184	162.19.139.184

IP Address	Status	Action
162.19.139.184	Active	Moloch
164.124.101.2	Active	Moloch

Flow	SID	Signature	Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53	2040353	ET COINMINER Observed DNS Query to Cryptocurrency Mining Pool Domain (xmr .2miners .com)	Crypto Currency Mining Activity Detected

Flow	Issuer	Subject	Fingerprint
TLS 1.3 192.168.56.101:49163 162.19.139.184:12222	None	None	None

section

{u'size_of_data': u'0x009a2200', u'virtual_address': u'0x00020000', u'entropy': 7.674662972205804, u'name': u'.data', u'virtual_size': u'0x009a21e0'}

entropy

7.67466297221

description

A section with a high entropy has been found

entropy

0.983990024938

description

Overall entropy of this PE file is high

Lionic	Trojan.Win32.Reflo.4!c
DrWeb	Trojan.Siggen21.8353
MicroWorld-eScan	Gen:Variant.Tedy.351054
ALYac	Gen:Variant.Tedy.351054
Malwarebytes	Crypt.Trojan.MSIL.DDS
VIPRE	Gen:Variant.Tedy.351054
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005a508c1 )
Alibaba	Trojan:Win64/Reflo.50f1f57a
K7GW	Trojan ( 005a508c1 )
CrowdStrike	win/malicious_confidence_90% (W)
Arcabit	Trojan.Tedy.D55B4E
Cyren	W64/Injector.BMR.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win64/GenKryptik.GIIA
Kaspersky	HEUR:Trojan.Win64.Reflo.pef
BitDefender	Gen:Variant.Tedy.351054
Avast	Win64:Evo-gen [Trj]
Tencent	Win32.Trojan.FalseSign.Zylw
Emsisoft	Gen:Variant.Tedy.351054 (B)
TrendMicro	TROJ_GEN.R002C0DGD23
McAfee-GW-Edition	Artemis!Trojan
FireEye	Gen:Variant.Tedy.351054
Sophos	Mal/Generic-S
Webroot	W32.Trojan.Gen
Google	Detected
MAX	malware (ai score=81)
Gridinsoft	Trojan.Win64.Gen.bot
Microsoft	Trojan:Win32/Xmrig!ic
ZoneAlarm	HEUR:Trojan.Win64.Reflo.pef
GData	Gen:Variant.Tedy.351054
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.R570073
McAfee	Artemis!6D1B84686D5D
Cylance	unsafe
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R002C0DGD23
Rising	Trojan.Kryptik!8.8 (TFE:5:tSjl4DNY5BP)
Ikarus	Trojan.Win64.Krypt
Fortinet	W64/GenKryptik.GIIA!tr
AVG	Win64:Evo-gen [Trj]
Cybereason	malicious.06b402
DeepInstinct	MALICIOUS

Min.exe