popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

art22.exe

PE64 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Feb. 4, 2024, 4:41 p.m. Feb. 4, 2024, 4:45 p.m.
Size 2.5MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 68bb10f285c0dbab62f5a8ad7c25ee7a
SHA256 77dee6099cf3f0bc7cd43f2f44ed61598fc915c30f5ca291338f883c9b86cc1d
CRC32 6ACF185C
ssdeep 49152:BWM4CdnWD+27FwZCdg4kP3qroi0a0Kr0jSIv0Jq:07CdnWa27CQdg4kPSoFa09jLvL
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)

Name Response Post-Analysis Lookup
pool.hashvault.pro
A 131.153.76.130
A 125.253.92.50
125.253.92.50
IP Address Status Action
104.26.5.15 Active Moloch
125.253.92.50 Active Moloch
164.124.101.2 Active Moloch
212.224.86.223 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2036289 ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) Crypto Currency Mining Activity Detected
TCP 192.168.56.101:49162 -> 125.253.92.50:80 2024792 ET POLICY Cryptocurrency Miner Checkin Potential Corporate Privacy Violation
TCP 192.168.56.101:49162 -> 125.253.92.50:80 2024792 ET POLICY Cryptocurrency Miner Checkin Potential Corporate Privacy Violation

Suricata TLS

No Suricata TLS

section .00cfg
host 104.26.5.15
host 212.224.86.223