Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 14, 2023, 9:41 a.m.	July 14, 2023, 9:45 a.m.

Size	9.8MB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`4a4db2df9923a697ee53212ace641d4e`
SHA256	`ac12db1c6b992748d9653359b4948969900e6b4c3f67f8c65bb3ce57a05c9f4b`
CRC32	`BB3970F0`
ssdeep	`196608:ZgSwA1gT/sqt0DZmgbRcBnkXpKweMoAyjC:ZgSGTKtmgbe1mTeML`
Yara	IsPE64 - (no description) PE_Header_Zero - PE File Signature

Name	Response	Post-Analysis Lookup
xmr.2miners.com	A 162.19.139.184	162.19.139.184

IP Address	Status	Action
162.19.139.184	Active	Moloch
164.124.101.2	Active	Moloch

Flow	SID	Signature	Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53	2040353	ET COINMINER Observed DNS Query to Cryptocurrency Mining Pool Domain (xmr .2miners .com)	Crypto Currency Mining Activity Detected

Flow	Issuer	Subject	Fingerprint
TLS 1.3 192.168.56.101:49163 162.19.139.184:12222	None	None	None

section

{u'size_of_data': u'0x009a2200', u'virtual_address': u'0x00020000', u'entropy': 7.593430997065514, u'name': u'.data', u'virtual_size': u'0x009a21e0'}

entropy

7.59343099707

description

A section with a high entropy has been found

entropy

0.983990024938

description

Overall entropy of this PE file is high

Lionic	Trojan.Win32.Reflo.4!c
DrWeb	Trojan.Siggen21.8329
MicroWorld-eScan	Gen:Variant.Tedy.370060
ALYac	Gen:Variant.Tedy.370060
Malwarebytes	Crypt.Trojan.MSIL.DDS
VIPRE	Gen:Variant.Tedy.370060
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005a508c1 )
Alibaba	Trojan:Win64/Reflo.d2e7730b
K7GW	Trojan ( 005a508c1 )
CrowdStrike	win/malicious_confidence_90% (W)
Arcabit	Trojan.Tedy.D5A58C
Cyren	W64/Injector.BMR.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win64/GenKryptik.GIIA
Kaspersky	HEUR:Trojan.Win64.Reflo.pef
BitDefender	Gen:Variant.Tedy.370060
Avast	Win64:Evo-gen [Trj]
Tencent	Win32.Trojan.FalseSign.Timw
Emsisoft	Gen:Variant.Tedy.370060 (B)
TrendMicro	TROJ_GEN.R002C0DGD23
McAfee-GW-Edition	Artemis!Trojan
FireEye	Gen:Variant.Tedy.370060
Sophos	Mal/Generic-S
Webroot	W32.Trojan.Gen
Google	Detected
MAX	malware (ai score=80)
Gridinsoft	Trojan.Win64.Gen.bot
Microsoft	Trojan:Win32/Xmrig!ic
ZoneAlarm	HEUR:Trojan.Win64.Reflo.pef
GData	Gen:Variant.Tedy.370060
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win.Generic.R570073
McAfee	Artemis!4A4DB2DF9923
Cylance	unsafe
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R002C0DGD23
Rising	Trojan.Kryptik!8.8 (TFE:5:tSjl4DNY5BP)
Ikarus	Trojan.Win64.Krypt
Fortinet	W64/GenKryptik.GIIA!tr
AVG	Win64:Evo-gen [Trj]
Cybereason	malicious.eb489d
DeepInstinct	MALICIOUS

My3.exe