MALICIOUS — 08e4c37ba1e0a52ae98d437c7050008dc336eb7d7294d80de6bc74ca7f8b3705

MALICIOUS — 08e4c37ba1e0a52ae98d437c7050008dc336eb7d7294d80de6bc74ca7f8b3705 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Vmprotect family. 7 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 08e4c37ba1e0a52ae98d437c7050008dc336eb7d7294d80de6bc74ca7f8b3705
SHA-1: 3d46d573870169c4553a6268e0b63ea745882ca1
MD5: 4273e7bc330ed8492333d29e84a52ad1
imphash: c6b0bd85f63e549c0536b6fceee78e43
ssdeep: 12288:MLry/neyx7f/A64dBNmw1GXlKtxwJ6tkxrgrRA8j30Nas+nmDUbe0eYvFLis:qKeyxTAJdB9JxtkgrxjkNasKAUXeYxv
TLSH: T15551334AA0142324C7D9C4CBDD303EBEFBA695F962CDA35632D1025E0A94D43DF182E9
Submitted as: 08e4c37ba1e0a52ae98d437c7050008dc336eb7d7294d80de6bc74ca7f8b3705
File type: pe · Size: 850732 bytes
Verdict: malicious (100/100) · Family: Vmprotect

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
ClamAV (daily): Win.Malware.Vmprotect-9878104-0
YARA: Yara-Rules community: YR_Packer_VMProtect
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Jaik!pz
Emsisoft (Emergency Kit): Gen:Variant.Barys.160809
Kaspersky (KVRT): HEUR:Trojan.Win32.Convagent.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Vmprotect-9878104-0 (rule Win.Malware.Vmprotect-9878104-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Jaik!pz (rule Trojan:Win32/Jaik!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Barys.160809 (rule Gen:Variant.Barys.160809) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Convagent.gen (rule HEUR:Trojan.Win32.Convagent.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_Packer_VMProtect (rule YR_Packer_VMProtect) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Themida/VMProtect (rule Themida/VMProtect) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Themida/VMProtect, high-entropy-sections:.vmp1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

99 behavior events · 0 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Program Files (x86)\ftxia\tppczmuljugib.exe - c9038a19e2b0472a71ba7d77df208c4993ff53f239cee25873958b4c4bb4a7b6
800538b0e68b836500b568ffb8e86ae985a0914a69d031e32dc1b0e06615d52d - 800538b0e68b836500b568ffb8e86ae985a0914a69d031e32dc1b0e06615d52d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

s.us
9.cf

Embedded IP addresses

51.105.71.137
52.123.252.245
4.230.171.124
172.215.188.232
20.42.179.204
4.144.132.114
20.165.94.54
20.42.65.84
74.178.240.61
104.18.33.89
20.42.65.94
52.110.12.14
52.110.12.38

File paths

Z:\X]

More Vmprotect samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report