Exes_c5535409ed97cb0c483cd7c31cdf973d_dat_2019-08-12_21_30.txt

* MalFamily: "Bitcoinminer"

* MalScore: 10.0

* File Name: "Exes_c5535409ed97cb0c483cd7c31cdf973d.dat"
* File Size: 2135466
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
* SHA256: "59044ddb0176647230470a213ad97f4385ae92d527d7a12f2f107bdc74c6ba06"
* MD5: "c5535409ed97cb0c483cd7c31cdf973d"
* SHA1: "a761cc94914625a10511f29857035e83c63700aa"
* SHA512: "a6a3fc5fff9acac2cd26385b8826f46e78a029ca273333b4947b56f037ab86c4bf58ac82c5b92953940429c5e9d46d7e33969851e6e278a5f682533f36030627"
* CRC32: "18C5220C"
* SSDEEP: "49152:hNSfNsBDlBoFGEwGs//VozeO7fY0rfzaE/we5Gc:h6sH+E/NozZrY0bHH5Gc"

* Process Execution:
    "Exes_c5535409ed97cb0c483cd7c31cdf973d.dat"


* Executed Commands:

* Signatures Detected:

        "Description": "Reads data out of its own binary image",
        "Details":

                "self_read": "process: Exes_c5535409ed97cb0c483cd7c31cdf973d.dat, pid: 1400, offset: 0x00000000, length: 0x00000007"


                "self_read": "process: Exes_c5535409ed97cb0c483cd7c31cdf973d.dat, pid: 1400, offset: 0x00000000, length: 0x00002000"


                "self_read": "process: Exes_c5535409ed97cb0c483cd7c31cdf973d.dat, pid: 1400, offset: 0x00000007, length: 0x000ffff0"


                "self_read": "process: Exes_c5535409ed97cb0c483cd7c31cdf973d.dat, pid: 1400, offset: 0x00001ff0, length: 0x00002000"


                "self_read": "process: Exes_c5535409ed97cb0c483cd7c31cdf973d.dat, pid: 1400, offset: 0x00003fe0, length: 0x00002000"


                "self_read": "process: Exes_c5535409ed97cb0c483cd7c31cdf973d.dat, pid: 1400, offset: 0x00005fd0, length: 0x00002000"


                "self_read": "process: Exes_c5535409ed97cb0c483cd7c31cdf973d.dat, pid: 1400, offset: 0x00007fc0, length: 0x00002000"


                "self_read": "process: Exes_c5535409ed97cb0c483cd7c31cdf973d.dat, pid: 1400, offset: 0x00009fb0, length: 0x00002000"


                "self_read": "process: Exes_c5535409ed97cb0c483cd7c31cdf973d.dat, pid: 1400, offset: 0x0000bfa0, length: 0x00002000"


                "self_read": "process: Exes_c5535409ed97cb0c483cd7c31cdf973d.dat, pid: 1400, offset: 0x0000df90, length: 0x00002000"


                "self_read": "process: Exes_c5535409ed97cb0c483cd7c31cdf973d.dat, pid: 1400, offset: 0x0000ff80, length: 0x00002000"


                "self_read": "process: Exes_c5535409ed97cb0c483cd7c31cdf973d.dat, pid: 1400, offset: 0x00011f70, length: 0x00002000"


                "self_read": "process: Exes_c5535409ed97cb0c483cd7c31cdf973d.dat, pid: 1400, offset: 0x00013f60, length: 0x00002000"


                "self_read": "process: Exes_c5535409ed97cb0c483cd7c31cdf973d.dat, pid: 1400, offset: 0x00015f50, length: 0x00002000"


                "self_read": "process: Exes_c5535409ed97cb0c483cd7c31cdf973d.dat, pid: 1400, offset: 0x00017f40, length: 0x00002000"


                "self_read": "process: Exes_c5535409ed97cb0c483cd7c31cdf973d.dat, pid: 1400, offset: 0x00018c86, length: 0x0000001c"




        "Description": "File has been identified by 37 Antiviruses on VirusTotal as malicious",
        "Details":

                "MicroWorld-eScan": "Trojan.BitCoinMiner.EL"


                "McAfee": "Artemis!C5535409ED97"


                "Cylance": "Unsafe"


                "K7AntiVirus": "Trojan ( 0001140e1 )"


                "Alibaba": "Trojan:Win32/NSISMiner.190306"


                "K7GW": "Trojan ( 0001140e1 )"


                "CrowdStrike": "win/malicious_confidence_100% (W)"


                "Arcabit": "Trojan.BitCoinMiner.EL"


                "Cyren": "W32/Trojan.ALNX-4263"


                "ESET-NOD32": "Win32/CoinMiner.SX"


                "APEX": "Malicious"


                "Kaspersky": "Trojan-Dropper.Win32.Agent.bjwjja"


                "BitDefender": "Trojan.BitCoinMiner.EL"


                "NANO-Antivirus": "Trojan.Win32.CoinMiner.fjpeeo"


                "ViRobot": "Trojan.Win32.S.CoinMiner.2135466"


                "Ad-Aware": "Trojan.BitCoinMiner.EL"


                "Emsisoft": "Trojan.BitCoinMiner.EL (B)"


                "F-Secure": "Trojan.TR/CoinMiner.LQ"


                "DrWeb": "Trojan.Siggen7.55331"


                "Qihoo-360": "Win32/Trojan.bcb"


                "Invincea": "heuristic"


                "McAfee-GW-Edition": "BehavesLike.Win32.Dropper.vc"


                "Trapmine": "malicious.high.ml.score"


                "FireEye": "Generic.mg.c5535409ed97cb0c"


                "Sophos": "Troj/Agent-BAWU"


                "Paloalto": "generic.ml"


                "Webroot": "W32.Malware.Gen"


                "Avira": "TR/CoinMiner.LQ"


                "AegisLab": "Trojan.Win32.Agent.4!c"


                "ZoneAlarm": "Trojan-Dropper.Win32.Agent.bjwjja"


                "GData": "Trojan.BitCoinMiner.EL"


                "TACHYON": "Trojan-Dropper/W32.Agent.2135466"


                "Malwarebytes": "Trojan.BitCoinMiner"


                "TrendMicro-HouseCall": "Coinminer_MALBTC.C-SFX"


                "Ikarus": "Trojan.Win32.CoinMiner"


                "Fortinet": "W32/Agent.BJWJJA!tr"


                "MaxSecure": "Trojan.Malware.1728101.susgen"





* Started Service:

* Mutexes:
    "DefaultTabtip-MainUI",
    "CicLoadWinStaWinSta0",
    "Local\\MSCTF.CtfMonitorInstMutexDefault1"


* Modified Files:

* Deleted Files:

* Modified Registry Keys:

* Deleted Registry Keys:

* DNS Communications:

* Domains:

* Network Communication - ICMP:

* Network Communication - HTTP:

* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: