MALICIOUS — 0968247b705179123b0e21d77ab2006b40f5470a0357213993d1119ced1b5b6d

MALICIOUS — 0968247b705179123b0e21d77ab2006b40f5470a0357213993d1119ced1b5b6d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Barys family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 0968247b705179123b0e21d77ab2006b40f5470a0357213993d1119ced1b5b6d
• SHA-1: 22e5a9f1e026ffa480991fc7d63b7275522e9e16
• MD5: efb8fb1456f4cd49c3b21bfc28e563da
• imphash: 7184fc9596d8d6d6d2b2b761ab9e2133
• ssdeep: 12288:SYzGVM3VyJgeE7uXsQeVtBKNkWPam1Eatq4k02zK+JTwmOGuGUYY/FZl1o:SPMl6gl7PJV3KCCtq3zK+JMlGuPw
• TLSH: T1504F23302A111916E330881A499E5DBD35C7BFF7B7161C8E16111AEC668AEFB2E305F1
• Submitted as: 0968247b705179123b0e21d77ab2006b40f5470a0357213993d1119ced1b5b6d
• File type: pe · Size: 717516 bytes
• Verdict: malicious (97/100) · Family: Barys

Detections (6 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
• YARA: Yara-Rules community: YR_Packer_VMProtect
• Detect It Easy (packer/type): DIE:Turbo Linker
• Microsoft Defender: Trojan:Win32/Barys.GXV!MTB
• Emsisoft (Emergency Kit): Gen:Variant.Barys.160809
• Kaspersky (KVRT): HEUR:Trojan.Win32.Convagent.gen

MITRE ATT&CK

• T1112
• T1105

Why this verdict

The malicious score of 97/100 is the fusion of 11 weighted signals:

• Microsoft Defender flagged Trojan:Win32/Barys.GXV!MTB (rule Trojan:Win32/Barys.GXV!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Barys.160809 (rule Gen:Variant.Barys.160809) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Convagent.gen (rule HEUR:Trojan.Win32.Convagent.gen) - engine signal, weight 0.55, confidence 0.85
• Contacted 12 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• YARA: Yara-Rules community flagged YR_Packer_VMProtect (rule YR_Packer_VMProtect) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
• MalwareAnalyser heuristics (entropy/packer) flagged Themida/VMProtect (rule Themida/VMProtect) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: Themida/VMProtect, high-entropy-sections:.vmp1, Turbo Linker - static signal, weight 0.25, confidence 0.55
• Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 5868) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

4932 behavior events · 1 ATT&CK techniques · 2 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• d.1.d.1.c.4.2.1.4.9.5.2.6.e.8.b.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa.
• 76.0.240.10.in-addr.arpa.
• 251.0.0.224.in-addr.arpa.
• 1.0.240.10.in-addr.arpa.
• wpad
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 85.52.40.23.in-addr.arpa.
• update.googleapis.com
• desktop-hsgcbep
• self.events.data.microsoft.com
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 251.0.0.224.in-addr.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa

Dropped files

• C:\Program Files (x86)\lmgvrpq\nbcmlzfv.exe - e303273075e8f782a7ed2e8c5486c77ebda124b7353b7d007cc3d79e52681374
• 7b8c4970debe3cbbd7532f1109e62425ccff6aa6c01d2b2e52027c690e803fde - 7b8c4970debe3cbbd7532f1109e62425ccff6aa6c01d2b2e52027c690e803fde

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded IP addresses

• 20.184.175.1
• 20.42.179.192
• 52.123.252.204
• 52.182.141.63
• 20.184.175.0
• 20.184.175.3
• 4.150.223.107
• 52.148.114.188
• 72.145.35.97
• 72.145.35.98
• 72.145.35.103
• 72.153.5.135
• 135.233.45.221
• 172.172.255.216
• 20.42.65.94
• 40.79.141.153
• 4.144.132.114
• 184.84.165.136
• 52.110.12.25
• 4.230.171.124

More Barys samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report