home

csrss.exe

The executable csrss.exe has been detected as malware by 42 anti-virus scanners. While running, it connects to the Internet address media-router-fp1.prod.media.vip.ir2.yahoo.com on port 443.
MD5:
65ac1d8049b4c670145c7013077cb78b

SHA-1:
25fe114ba0f1a769a29301c2290576b1611a65da

SHA-256:
0045031dd463ba85245f8c8b45b2588a930c336889be14130b6639f4008222b4

Scanner detections:
42 / 68

Status:
Malware

Analysis date:
5/21/2024 11:36:41 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Win32.Brontok.NB
335

AegisLab AV Signature
Troj.W32.Gen
2.1.4+

Agnitum Outpost
I-Worm.Brontok
7.1.1

AhnLab V3 Security
HEUR/Fakon.mwf
2016.03.02

Avira AntiVirus
WORM/Brontok.W.14
8.3.3.2

Arcabit
Win32.Brontok.NB
1.0.0.656

avast!
Win32:Brontok-CE [Wrm]
2014.9-160306

AVG
I-Worm/Brontok.X
2017.0.2813

Baidu Antivirus
Trojan.Win32.Agent
4.0.3.1636

Bitdefender
Win32.Brontok.NB
1.0.20.330

Bkav FE
W32.RontokbroC
1.3.0.7717

Clam AntiVirus
Worm.Brontok.AL
0.98/21511

Comodo Security
Worm.Win32.Brontok.CO
24395

Dr.Web
BackDoor.Generic.3162
9.0.1.066

Emsisoft Anti-Malware
Win32.Brontok.NB
8.16.03.06.12

ESET NOD32
Win32/Brontok.CO
10.13111

Fortinet FortiGate
W32/Generic.AC.1023
3/6/2016

F-Prot
W32/Brontok.C.gen
v6.4.7.1.166

F-Secure
Win32.Brontok.NB
11.2016-06-03_1

G Data
Win32.Brontok.NB
16.3.25

IKARUS anti.virus
Virus.Win32.Alman
t3scan.2.0.8.0

K7 AntiVirus
Trojan
13.214.18907

Kaspersky
Email-Worm.Win32.Brontok
14.0.0.560

Malwarebytes
Trojan.Dropper
v2016.03.06.12

McAfee
W32/Rontokbro.gen@MM
5600.6469

Microsoft Security Essentials
Trojan:Win32/Senta!rfn
1.1.12400.0

MicroWorld eScan
Win32.Brontok.NB
17.0.0.198

NANO AntiVirus
Trojan.Win32.Brontok.vpwh
1.0.18.6677

nProtect
Worm/W32.Brontok.49152.I
16.02.29.01

Panda Antivirus
W32/Brontok.N.worm
16.03.06.12

Qihoo 360 Security
Win32/Worm.Email-Worm.343
1.0.0.1120

Quick Heal
W32.Brontok.Q
3.16.14.00

Rising Antivirus
PE:Worm.Mail.Win32.Brontok.in!1389746 [F]
23.00.65.16304

Sophos
W32/Brontok-Gen
4.98

SUPERAntiSpyware
Trojan.Agent/Gen-SV
9283

Total Defense
Win32/Robknot.AK
37.1.62.1

Trend Micro House Call
WORM_RONTKBR.GEN
7.2.66

Trend Micro
WORM_RONTKBR.GEN
10.465.06

Vba32 AntiVirus
TScope.Trojan.VB
3.12.26.4

VIPRE Antivirus
Email-Worm.Win32.Brontok.ik
47586

ViRobot
I-Worm.Win32.Brontok.45435[h]
2014.3.20.0

Zillya! Antivirus
Worm.Brontok.Win32.26
2.0.0.2695

File size:
48 KB (49,152 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\csrss.exe

File PE Metadata
OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
5.12

CTPH (ssdeep):
768:l6r/0pcM8cJZZD673K383EJBZ4BQTbfqBWV5WV4Pv35BMCX5BMC3:8bEcM84g3IEIZ4BQ3fqBWy2X5L5z

Entry address:
0x32F62

Entry point:
E9, ED, D1, FC, FF, 0C, 80, 02, 00, 00, 00, 00, 00, 00, 00, 00, 00, 39, 2F, 03, 00, 0C, 80, 02, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.1559

Packer / compiler:
MEW, 0x11 SE v1.2

Code size:
512 Bytes (512 bytes)

Mozilla Extension
Name:
extensions.exe

Id:
extensions


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP SSL):
Connects to media-router-fp1.prod.media.vip.ir2.yahoo.com  (188.125.80.144:443)

TCP (HTTP SSL):
Connects to ir1.fp.vip.ir2.yahoo.com  (46.228.47.115:443)

TCP (HTTP SSL):
Connects to ats.sbs.vip.dc11.lumsb.com  (8.12.146.61:443)

TCP (HTTP):
Connects to unknown.prolexic.com  (72.52.4.121:80)

Remove csrss.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.