MALICIOUS — 0581a38d1dc61e0da50722cb6c4253d603cc7965c87e1e42db548460d4abdcae.bin
MALICIOUS — 0581a38d1dc61e0da50722cb6c4253d603cc7965c87e1e42db548460d4abdcae.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Lethic family. 6 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
0581a38d1dc61e0da50722cb6c4253d603cc7965c87e1e42db548460d4abdcae - SHA-1:
bf812905fb47da8510411d404fa08be683f9ecd6 - MD5:
39192da38ad821d5e6cd6b68843dc81d - imphash:
ada579361a8441a77318bb8786829f7e - ssdeep:
1536:s7HNncOhP3t2RTHlApSBz2l0a4DPlQ3DEpKGsme1j5Il3fsjZma3n8WTPN1pitls:6WOFgYEylBmGyKGU1Ys951RVb3n1 - TLSH:
T17F3E6D9E113A3705D62FE33179046F0FA252B0FF56AA178A6192C18F8D11313E67936B - Submitted as: 0581a38d1dc61e0da50722cb6c4253d603cc7965c87e1e42db548460d4abdcae.bin
- File type: pe · Size: 147456 bytes
- Verdict: malicious (98/100) · Family: Lethic
Detections (6 of 51 engines)
- MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
- ClamAV (daily): {MD5}bin.trojan.lethic.8011.UNOFFICIAL
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Detect It Easy (packer/type): DIE:Microsoft Linker
- Microsoft Defender: Trojan:Win32/Lethic.B
- Emsisoft (Emergency Kit): Gen:Variant.Symmi.43995
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged {MD5}bin.trojan.lethic.8011.UNOFFICIAL (rule
{MD5}bin.trojan.lethic.8011.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Lethic.B (rule
Trojan:Win32/Lethic.B) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.Symmi.43995 (rule
Gen:Variant.Symmi.43995) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule
DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
11847 behavior events · 1 ATT&CK techniques · 7 dropped files.
Runtime network
- searchapp.bundleassets.example
- www.msftconnecttest.com
- www.bing.com
- desktop-hsgcbep
- config.edge.skype.com
- aefd.nelreports.net
- dns.msftncsi.com
- watson.events.data.microsoft.com
- g.live.com
- self.events.data.microsoft.com
- edge.microsoft.com
- www.msftncsi.com
- time.windows.com
- settings-win.data.microsoft.com
- licensing.mp.microsoft.com
- tsfe.trafficshaping.dsp.mp.microsoft.com
- geover.prod.do.dsp.mp.microsoft.com
- cp801.prod.do.dsp.mp.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
- 192.168.122.108
Dropped files
- /opt/CAPEv2/storage/analyses/5130/files/2f65fa9c7ed712f493782abf91467f869419a2f8b5adf23b44019c08190fa3f3 -
2f65fa9c7ed712f493782abf91467f869419a2f8b5adf23b44019c08190fa3f3 - f95efe3ccbd55d03d56958d4518676f69385f43c102f41f700bbc784d6695c4a -
f95efe3ccbd55d03d56958d4518676f69385f43c102f41f700bbc784d6695c4a - daea5f81581d0538d2cf07c9caa772fcf7fc6d127a6960770691cd2d505ab886 -
daea5f81581d0538d2cf07c9caa772fcf7fc6d127a6960770691cd2d505ab886 - 38681fbaee3332039b5ad48c52313f43983b702b72e06cb779cfee2c2a9975a4 -
38681fbaee3332039b5ad48c52313f43983b702b72e06cb779cfee2c2a9975a4 - 9c08aaf541dcfa2f06391a4658664656c7461a52b325200e45b538be962b0d9f -
9c08aaf541dcfa2f06391a4658664656c7461a52b325200e45b538be962b0d9f - c34450ca0f27df637cf0f189809df6282269dea7aa4852f14306144e64b2dbe8 -
c34450ca0f27df637cf0f189809df6282269dea7aa4852f14306144e64b2dbe8 - b096e8ca50631b4912850c8b116a7f554c38de3ca0fe2b0316e89c23a462bb5c -
b096e8ca50631b4912850c8b116a7f554c38de3ca0fe2b0316e89c23a462bb5c
Embedded domains
- www.nat32.com
- aefd.nelreports.net
More Lethic samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report