ScreenShot
| Created | 2024.01.28 10:03 | Machine | s1_win7_x6403 |
| Filename | z73.exe | ||
| Type | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 44 detected (AIDetectMalware, malicious, high confidence, score, MsilFC, S29960883, Artemis, MSILZilla, unsafe, CoinMiner, V0x9, Attribute, HighConfidence, GenericRXAA, CoinminerX, Miner, HackTool, VulnDriver, CLASSIC, MulDrop19, Generic Reputation PUA, alswv, ai score=84, MSILKrypt, R511615, ZemsilF, @p0@aS9k6ml, BitCoinMiner, GdSda, Gencirc, epmMOkZEavY, Static AI, Malicious PE, susgen, confidence, 100%) | ||
| md5 | 9539ab89d01b301836b1d22e71dd55ed | ||
| sha256 | 0b091151686ff9bf1f4120ce144f75fc1aacfcad07b14187eb8e85b224a766e7 | ||
| ssdeep | 98304:tvUOUlzvyfQprVfSHy9fierzHjhlTkil3IVcWvy:tvUO6vRvSy1Ll3WJ | ||
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 | ||
| impfuzzy | 3:rGsLdAIEK:tf | ||
Network IP location
Signature (15cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 44 AntiVirus engines on VirusTotal as malicious |
| watch | A stratum cryptocurrency mining command was executed |
| watch | Communicates with host for which no DNS query was performed |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks adapter addresses which can be used to detect virtual network interfaces |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Communication to multiple IPs on high port numbers possibly indicative of a peer-to-peer (P2P) or non-standard command and control protocol |
| notice | Creates executable files on the filesystem |
| notice | Drops a binary and executes it |
| notice | Drops an executable to the user AppData folder |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Command line console output was observed |
| info | This executable has a PDB path |
Rules (16cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (download) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| watch | Win32_Trojan_PWS_Net_1_Zero | Win32 Trojan PWS .NET Azorult | binaries (upload) |
| info | Is_DotNET_EXE | (no description) | binaries (upload) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | IsPE64 | (no description) | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (13cnts) ?
Suricata ids
ET POLICY Cryptocurrency Miner Checkin
ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org)
ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org)
PE API
IAT(Import Address Table) Library
mscoree.dll
0x402000 _CorExeMain
EAT(Export Address Table) is none
mscoree.dll
0x402000 _CorExeMain
EAT(Export Address Table) is none