MALICIOUS — 0bedadf9dcb2337d6825d9f393f54a5ab87c170d9319fc025fc8571560728234

MALICIOUS — 0bedadf9dcb2337d6825d9f393f54a5ab87c170d9319fc025fc8571560728234 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Amnesia family. 13 of 55 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: 0bedadf9dcb2337d6825d9f393f54a5ab87c170d9319fc025fc8571560728234
SHA-1: f8fc706395c8193b3deb834b381ac3ce6ee710d1
MD5: d0cd8c76b3750430b4b7cf931c2dc0ad
imphash: e0108c6f760b9bf79f1f3e8200481dd8
ssdeep: 49152:2O9TJ6dZ4gTkZL8OzMhzGTKVul3xOb6ph7ogtHUujFddtL2tLII2wQ+LnUZbodvS:b6X4gscW77bFZV2VHnU9ky
TLSH: T187681ADE702E2204D2BAE9319864959CC0B271B53174BD4D0A0B416620EA2F7FDF7F5A
Submitted as: 0bedadf9dcb2337d6825d9f393f54a5ab87c170d9319fc025fc8571560728234
File type: pe · Size: 7441485 bytes
Verdict: malicious (100/100) · Family: Amnesia

Detections (13 of 55 engines)

capa (capabilities): capability:credential-access
MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Worm.Delf-6980489-0
YARA: bartblaze: BB_Clipbanker
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: InQuest Labs: CVE_2018_4878_0day_ITW
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
YARA: Yara-Rules community: YR_AntiDebug_Checks
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Worm:Win32/Xolxo.A
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Amnesia.1
Kaspersky (KVRT): Virus.Win32.Lamer.fg

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 19 weighted signals:

ClamAV (daily) flagged Win.Worm.Delf-6980489-0 (rule Win.Worm.Delf-6980489-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload: minidump_upload.exe - dynamic signal, weight 0.62, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
Contacted 27 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: bartblaze flagged BB_Clipbanker (rule BB_Clipbanker) - engine signal, weight 0.35, confidence 0.70
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
YARA: InQuest Labs flagged CVE_2018_4878_0day_ITW (rule CVE_2018_4878_0day_ITW) - engine signal, weight 0.35, confidence 0.70
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: https://www.mendeley.com/library, https://service.elsevier.com/app/answers/detail/a_id/22094/kw/migrate/supporthub/mendeley/, http://support.mendeley.com/customer/portal/articles/227955 - static signal, weight 0.35, confidence 0.60
1 behavioral detection(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

28890 behavior events · 0 ATT&CK techniques · 54 dropped files.

Dropped files

C:\Program Files\LibreOffice\program\odbcconfig.exe - ce7e32c0c37deb67bc1303aaa5cfdd0a706b27e2a6a6a5e502ac9d1ec2da7fec
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe - 3e27cc6407fc7d7b6e26495c6ff849c23cf3b6e9c8a885ea742ad7b3109af536
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - 51e57fdf672acec905dc11fb467293a6c1251683cb92e769d451e46b9e0e92d6
C:\Program Files\LibreOffice\program\gengal.exe - 0e03675850241d06080af9ec470649ca4a006222c4ff5d1b05029f1751fecf91
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaw.exe - bf7151fdb2f5859393f5688b2921b58c676275dbd065195546965411bdaf7281
C:\Program Files\Internet Explorer\ieinstal.exe- - 0fbfc2622dc10c0cabc1e26a75f72d3e30349fd60533bce993d40e65a79fc854
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jrunscript.exe - 3c6d62569a6dbad19d57ab33039ea0626a3eaf4386fa8b207c136957b26005ab
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - f106076996fb931ee6e6840c9502191ef6c8f2c91559e1742d4c761125e262db
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - c4c65264e0d3b9b31c5262259ec4b8af6ec62a1fff918a98910aabf17f015959
C:\Program Files\Internet Explorer\ielowutil.exe - 4e307bc9c49a98187e384a9309fbbf49e4fde50b2b989cede11bb8eb2c8debdc
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccesswalker.exe - 19198c32bd69b806c0120df24c93c2f5461976aa81473b2575e44d543ca6d33f
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe - 8c435a45123e88410f42259fcb3b303b5f60ce00e01d8d4a9c5bd342bf51e184
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - 599e533da3261e2fc678ccc3393bb90cafa7ce620196168b9c5cb41a4e48099b
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccessinspector.exe - a7487ee88d94f322148489c818cc861ee1e77ec31ce5b5e7b5e999c0d5acf6f6

Embedded URLs

http://www.microsoft.com/exporting
https://www.mendeley.com/library
https://service.elsevier.com/app/answers/detail/a_id/22094/kw/migrate/supporthub/mendeley/
http://support.mendeley.com/customer/portal/articles/227955
http://p.yusukekamiyamane.com/
https://citationstyles.org
https://github.com/Juris-M/citeproc-js
https://plasma.kde.org
https://www.zotero.org/
https://rrchnm.org/
https://www.gmu.edu/
https://www.elsevier.com/legal/elsevier-website-terms-and-conditions
https://www.elsevier.com/legal/privacy-policy
http://citationstyles.org/
https://github.com/citation-style-language/styles
https://csl.mendeley.com
http://creativecommons.org/licenses/by-sa/3.0/
https://www.mendeley.com/guides?dgcid=Mendeley_Desktop_Help-menu-Help-guides
https://www.mendeley.com?dgcid=Mendeley_Desktop_Help-menu-website
https://service.elsevier.com/app/home/supporthub/mendeley/?dgcid=Mendeley_Desktop_Help-menu-FAQ
https://service.elsevier.com/app/contact/supporthub/mendeley?dgcid=Mendeley_Desktop_Help-menu-Contact-Support
https://nw-umwatson.events.data.microsoft.com/Telemetry.Request
https://crashpad.chromium.org/
https://crashpad.chromium.org/bug/new
http://www.w3.org/2000/xmlns/

Embedded domains

www.microsoft.com
www.mendeley.com
service.elsevier.com
support.mendeley.com
p.yusukekamiyamane.com
citationstyles.org
github.com
plasma.kde.org
www.zotero.org
rrchnm.org
www.gmu.edu
www.elsevier.com
csl.mendeley.com
creativecommons.org
field.cc
nw-umwatson.events.data.microsoft.com
crashpad.chromium.org
augloop-int.officeppe.com
registry.cc
blink.net
arena.cc
settings.cc
zip.cc
thunks.cc
thread.cc

Embedded IP addresses

10.3.4.1
5.2.3.5
1.101.3.4
23.02.45.06
25.46.62.85
27.24.53.59
2.7.6.1
11.0.14.16
20.184.175.18
20.42.179.192
57.155.101.212
52.253.84.76
4.230.171.124
74.178.76.128
4.150.223.106
74.178.76.54
40.99.133.242
52.123.129.14
20.236.44.162
52.123.128.14
52.168.117.169
52.123.252.213
135.234.160.245
203.26.79.13
52.110.12.4

Registry keys

HKEY_CURRENT_USER\Software\Classes
HKEY_LOCAL_MACHINE\Software\Classes
HKEY_LOCAL_MACHINE\Software\Valve\Steam\Apps\%d
HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME\audio/x-aiff]
HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME\audio/aiff]
HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\.aiff]
HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\.aifc]
HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\.aif]
HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME\video/quicktime]
HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\.qt]
HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\.mov]
HKLM\System\CurrentControlSet
HKLM\Software\Microsoft\Windows
HKEY_LOCAL_MACHINE\Software\Adobe\Acrobat
HKEY_LOCAL_MACHINE\Software\Adobe\Adobe
HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe
HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat
HKEY_USERS\[USER_SID]\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.adobe.acrobat.chrome_webcapture
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active
HKEY_LOCAL_MACHINE\Software\Adobe\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsof
hklm\software

File paths

D:\a\1\s\exe\Win32\Release\WinObj.pdb
C:\jenkins\workspace\Desktop_Release_Build\src\ui\MainWindow.cpp
C:\jenkins\workspace\Desktop_Release_Build\src\ui\ImportExportDialogProvider.cpp
C:\jenkins\workspace\Desktop_Release_Build\src\ui\AnnotationsExportSettingsDialog.cpp
C:\jenkins\workspace\Desktop_Release_Build\src\ui\FileListEdit.cpp
C:\jenkins\workspace\Desktop_Release_Build\src\ui\DocumentEditor.cpp
C:\jenkins\workspace\Desktop_Release_Build\src\ui\JSDataStore.cpp
C:\jenkins\workspace\Desktop_Release_Build\src\ui\JSNetworkResponse.cpp
c:\buildslave\steam_rel_client_win32\build\src\public\tier1\utlstring.h
c:\buildslave\steam_rel_client_win32\build\src\common\crypto_textencode.cpp
c:\buildslave\steam_rel_client_win32\build\src\public\tier1\utlvector.h
c:\buildslave\steam_rel_client_win32\build\src\common\keypair.cpp
c:\buildslave\steam_rel_client_win32\build\src\common\crypto_25519_donna.cpp
c:\buildslave\steam_rel_client_win32\build\src\common\crypto_digest_openssl.cpp
c:\buildslave\steam_rel_client_win32\build\src\common\crypto_rsa_openssl.cpp
c:\buildslave\steam_rel_client_win32\build\src\common\enum_names.cpp
c:\buildslave\steam_rel_client_win32\build\src\common\globals.cpp
c:\buildslave\steam_rel_client_win32\build\src\common\keyvaluesignature.cpp
c:\buildslave\steam_rel_client_win32\build\src\common\opensslwrapper.cpp
c:\buildslave\steam_rel_client_win32\build\src\common\registry.cpp
c:\buildslave\steam_rel_client_win32\build\src\common\serviceinstallscript.cpp
c:\buildslave\steam_rel_client_win32\build\src\common\symlink.cpp
c:\buildslave\steam_rel_client_win32\build\src\common\win32service.cpp
c:\buildslave\steam_rel_client_win32\build\src\public\tier1\smartptr.h
c:\buildslave\steam_rel_client_win32\build\src\common\windowshelper.cpp

More Amnesia samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report