MALICIOUS — 035a6fa4064026934d0a631c9c1f1b9a5225b407c212bb99049d18b995b8e8a4

MALICIOUS — 035a6fa4064026934d0a631c9c1f1b9a5225b407c212bb99049d18b995b8e8a4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Khalesi family. 9 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

• SHA-256: 035a6fa4064026934d0a631c9c1f1b9a5225b407c212bb99049d18b995b8e8a4
• SHA-1: fee10d2bfbb364f7c522df2c4f457573feb9e611
• MD5: 72a3d6ab02a0680fad2fb961dac93e8a
• imphash: ec32c562c29db30f2b2403ddea2a8798
• ssdeep: 49152:5iWTC1UM/5HwWMfiBQ78O+IxnFUEBrFz/9wbvI9mvtj2n8KuTq9M:5055Hw+k5zFT65h2Q
• TLSH: T14B5E02EDB2069B55D0E2876478B24B1D002EB5C425F62DC906CBD08933ECCDF98765EA
• Submitted as: 035a6fa4064026934d0a631c9c1f1b9a5225b407c212bb99049d18b995b8e8a4
• File type: pe · Size: 2957824 bytes
• Verdict: malicious (100/100) · Family: Khalesi

Detections (9 of 56 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• capa (capabilities): capability:collection/keylog
• ClamAV (daily): Win.Dropper.Khalesi-9937869-0
• YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
• YARA: Yara-Rules community: YR_AntiVM_Sandbox
• Microsoft Defender: Program:Win32/Wacapew.C!ml
• Kaspersky (KVRT): UDS:DangerousObject.Multi.Generic

MITRE ATT&CK

• T1071.001
• T1497
• T1486
• T1057
• T1056.001
• T1055

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 18 weighted signals:

• ClamAV (daily) flagged Win.Dropper.Khalesi-9937869-0 (rule Win.Dropper.Khalesi-9937869-0) - engine signal, weight 0.90, confidence 0.95
• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.70, confidence 0.70
• Microsoft Defender flagged Program:Win32/Wacapew.C!ml (rule Program:Win32/Wacapew.C!ml) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:DangerousObject.Multi.Generic (rule UDS:DangerousObject.Multi.Generic) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• YARA: Yara-Rules community flagged YR_AntiVM_Sandbox (rule YR_AntiVM_Sandbox) - engine signal, weight 0.40, confidence 0.70
• YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
• capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
• query domain / anti-analysis (rule query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: https://autohotkey.com, https://i.ibb.co/vQX4Y0L/123.png, https://pastebin.com/raw/hkytwPyt - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
• encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60
• Extracted generic config (12 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

99 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• update.googleapis.com
• desktop-hsgcbep
• login.live.com
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• licensing.mp.microsoft.com
• assets.msn.com
• www.bing.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• www.msftconnecttest.com/connecttest.txt

Embedded URLs

• https://autohotkey.com
• https://i.ibb.co/vQX4Y0L/123.png
• https://pastebin.com/raw/hkytwPyt
• https://pastebin.com/raw/nvPqZVcV
• https://www.4sync.com/web/directDownload/cguzaB0Y/fhoiRv1v.fadbbb1408506ef940eb4f14be67eeb3
• https://www.4sync.com/web/directDownload/lSxcr0ph/fhoiRv1v.68261adf5b5dbb336e7dc1dcb97a508d
• http://worldtimeapi.org/api/ip
• https://drive.google.com/uc?export=download&confirm=no_antivirus&id=1_Bs5MgEPimMIhuul4n6DgWtQcb9mElJL
• https://drive.google.com/uc?export=download&confirm=no_antivirus&id=1FB8Vw47eCclkDzR1Vaksyvn-AfgEmeL1
• https://drive.google.com/uc?export=download&confirm=no_antivirus&id=1Y-p9JC1weECYV99NlhYmgJ9gM72CGZ34
• https://drive.google.com/uc?export=download&confirm=no_antivirus&id=1LeB3N0vAOO_JqqxANCi-swiJC2muRCTo
• https://drive.google.com/uc?export=download&confirm=no_antivirus&id=1VfDzDdelgkseEE4tjUG9XiN-1i5YtmRI
• https://drive.google.com/uc?export=download&confirm=no_antivirus&id=1a-yGtGcsoyX5vxRyOM0jj9-DhLEgDHFm
• https://drive.google.com/uc?export=download&confirm=no_antivirus&id=1-1fSZgSH-ogaynfJfMGCuaC1SWKftIIm
• https://www.4sync.com/web/directDownload/17qVEgBQ/fhoiRv1v.e5d7ed8f3cbc629dbe187ac933d997fc
• https://pastebin.com/raw/7tfHddH2
• https://pastebin.com/raw/jGgZJ0fZ
• https://pastebin.com/raw/FSA9Kq4n
• https://tarkovelite.com
• https://pastebin.com/raw/uPwUNWUH
• http://schemas.microsoft.com/SMI/2005/WindowsSettings
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• autohotkey.com
• i.ibb.co
• pastebin.com
• www.4sync.com
• 0.pool.ntp.org
• 1.pool.ntp.org
• 2.pool.ntp.org
• 3.pool.ntp.org
• worldtimeapi.org
• drive.google.com
• tarkovelite.com
• schemas.microsoft.com

Embedded IP addresses

• 1.0.0.2
• 4.150.223.101
• 20.247.185.124
• 4.230.171.124
• 52.110.12.50

File paths

• C:\Users\Default\Update.bat
• C:\Windows\TarkovElite.png
• C:\Users\Default\123.txt
• C:\Users\Default\123.txt,
• C:\Users\Default\234.txt
• C:\Users\Default\234.txt,
• C:\Users\Default\update.bat
• C:\Users\Default\update.bat,,hide
• C:\Windows\System32\sloppa.dll
• C:\Windows\System32\sloppa.dll,
• C:\Users\Default\spoof.exe,
• C:\Users\Default,
• C:\Windows\telite.txt
• C:\Windows\telite.txt,
• C:\Windows\System32\MSEdge.dll
• C:\Windows\System32\Browser
• C:\Windows\System32\MSEdge.dll,
• C:\Users\Default\spoof.exe
• b:\-D

More Khalesi samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report