MALICIOUS — 02e7540092b4bde40884841f2a12564ac129e7e4c154f265c13fd370755a337f

MALICIOUS — 02e7540092b4bde40884841f2a12564ac129e7e4c154f265c13fd370755a337f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Gamarue family. 8 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 02e7540092b4bde40884841f2a12564ac129e7e4c154f265c13fd370755a337f
SHA-1: 0090bb25bb443f7656885b65f33b9b0787479262
MD5: 033cdf987d8ac0af067f98f734d25372
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 49152:+gPx7daAX2WQRWj+6yw/yEMkubaucLj2My3yrbrPS0HzF+cjyrTj5PWm4+ul:+gPxBFXiMj+6yIgbaucLK53ab+0TF+c
TLSH: T19A5E338873B0A241F8F88EEB584D889FC04FDAD50C3977A1B14513984E4A37BD96BC65
Submitted as: 02e7540092b4bde40884841f2a12564ac129e7e4c154f265c13fd370755a337f
File type: pe · Size: 3011072 bytes
Verdict: malicious (99/100) · Family: Gamarue

Detections (8 of 52 engines)

capa (capabilities): capability:execution/powershell
MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Packed.Gamarue-6989496-0
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
Detect It Easy (packer/type): DIE:Babel .NET 3.X
Kaspersky (KVRT): UDS:DangerousObject.Multi.Generic
Microsoft Defender: Trojan:MSIL/Zilla.KA!MTB
Emsisoft (Emergency Kit): Gen:Variant.Jalapeno.3404

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Packed.Gamarue-6989496-0 (rule Win.Packed.Gamarue-6989496-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 60 external host(s) at runtime (15 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Babel .NET 3.X (rule DIE:Babel .NET 3.X) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 4.2.0.1 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text, Babel .NET 3.X - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

6175 behavior events · 2 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

e.cc

Embedded IP addresses

4.2.0.1
52.123.252.197
51.104.15.252
52.123.252.194
4.230.171.124
72.154.7.104
20.165.94.63
85.210.196.11
4.150.223.113
20.231.239.246
135.233.45.222
13.69.239.69
4.144.132.114
52.168.117.168
74.178.240.61
20.247.185.124
74.178.240.51
172.215.188.232
74.179.71.159
52.123.128.14
52.168.112.67
4.247.188.224
52.123.129.14
172.178.240.161
52.110.12.52

File paths

W:\`
S:\Z
C:\Users\Sprite\Desktop\testvicproc\main.cpp
C:\Users\Sprite\Desktop\testvicproc
c:\crossdev\b4.4.1-tdm-1\build-sjlj\mingw32\libgcc

More Gamarue samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report