MALICIOUS — 04bf0854ba764ccdb956cf225ef92fec57bf800845d21220af22cb8b77d08cec

MALICIOUS — 04bf0854ba764ccdb956cf225ef92fec57bf800845d21220af22cb8b77d08cec is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Vobfus family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 04bf0854ba764ccdb956cf225ef92fec57bf800845d21220af22cb8b77d08cec
SHA-1: 9a6cdff8a54282773e38f119439e86e2966c514b
MD5: 8b0c5b9d085403c6f9af06d4abdf1d0b
imphash: 366d6109d160103d267b13fb3bdb95d3
ssdeep: 1536:KUE6hwRpJuBxeDtMYHa27J14ltxporZ45igA:DE6hwRDkeV6gJ1uCt45VA
TLSH: T19B3D3B847EADD4F1E167C603CAC579FC224ED10A792297B826E68B0B01D22F7703562D
Submitted as: 04bf0854ba764ccdb956cf225ef92fec57bf800845d21220af22cb8b77d08cec
File type: pe · Size: 126976 bytes
Verdict: malicious (100/100) · Family: Vobfus

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.VB-1668
Microsoft Defender: Worm:Win32/Vobfus!pz
Emsisoft (Emergency Kit): Gen:Variant.VBInject.11
Trellix Stinger (McAfee): Trojan-FAEH!8B0C5B9D0854
Kaspersky (KVRT): Trojan.Win32.Vobfus.rku

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Trojan.VB-1668 (rule Win.Trojan.VB-1668) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Worm:Win32/Vobfus!pz (rule Worm:Win32/Vobfus!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.VBInject.11 (rule Gen:Variant.VBInject.11) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FAEH!8B0C5B9D0854 (rule Trojan-FAEH!8B0C5B9D0854) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Vobfus.rku (rule Trojan.Win32.Vobfus.rku) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

46731 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\ynbiip.exe - 40f015bee6637955bf33d4005ca9d4b21ab0c113575e81371f4d2f5192ea8ee6
1e798047360dc38bbfbdceb0c9890179af2ebddd22c9b0c6fcf13e0a4461785f - 1e798047360dc38bbfbdceb0c9890179af2ebddd22c9b0c6fcf13e0a4461785f
20c7587ccd02bcb191ff33f70b6997e31072cced58ade01c9f8c3ec87e5718af - 20c7587ccd02bcb191ff33f70b6997e31072cced58ade01c9f8c3ec87e5718af

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

r.net
s1.pl
ns1.spansearcher.net
ns1.spinsearcher.org
ns1.player1352.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.112.67
4.230.171.124
40.84.97.4
20.247.185.124
20.165.94.63
20.184.175.17
74.178.240.51
172.64.154.167
92.223.78.30
52.110.12.48
52.110.12.3
20.42.65.91
52.168.117.168
72.154.7.100
52.148.114.188
52.110.12.30

File paths

C:\Program

More Vobfus samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report