MALICIOUS — 0c1f39738f6c9fa0b57d01c03aad53277177070d33b7348189b18adba93b8880

MALICIOUS — 0c1f39738f6c9fa0b57d01c03aad53277177070d33b7348189b18adba93b8880 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Mbrlock family. 6 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 0c1f39738f6c9fa0b57d01c03aad53277177070d33b7348189b18adba93b8880
SHA-1: f1af69d278d94d06b271f3a4cfb8d3ba588a13e1
MD5: 3ee4fac638fd0cfa347758bd3e813afe
imphash: 8d08b9aff260461badc1821f4f717247
ssdeep: 393216:eg7usg7usg7usg7usg7usg7usg7usg7uN:zSRSRSRSRSRSRSRSN
TLSH: T11C70237E130B7403DE2AD62564863FCD08637C69507D5888553B84BE83F68EB27816AA
Submitted as: 0c1f39738f6c9fa0b57d01c03aad53277177070d33b7348189b18adba93b8880
File type: pe · Size: 16634880 bytes
Verdict: malicious (100/100) · Family: Mbrlock

Detections (6 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Mbrlock-9779766-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Blocker.EM!MTB
Emsisoft (Emergency Kit): Gen:Variant.Genie.689
Kaspersky (KVRT): Trojan-Ransom.Win32.Blocker.qnlx

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Trojan.Mbrlock-9779766-0 (rule Win.Trojan.Mbrlock-9779766-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload: OScam Collection.htm - dynamic signal, weight 0.62, confidence 0.90
2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 28 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

24077 behavior events · 3 ATT&CK techniques · 13 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\top2.gif - 7cb06f8dbfa5f13359e2dcee822fae73ef01a00ff29ce99ec401a73017875aee
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db - 371c7f5d4a515a36ffe3da6e9a45753772e1a81b7c61c269295063fbc5fde989
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db - 723ef109024a7d1b03e6335ee53d0140027b2224765fe5fed23d1b07906a03a6
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db - d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
C:\Users\analyst\AppData\Local\Temp\OScam Collection.htm - fcd785d06efc594628f2460b3098d5b97633f2e4587be0fa50dd8cd60a447407
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db - 0dc9e64e2b9e237739a6d816d97177119857a547689e610a2087e165833e1d46
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db - a87402eefbc4625ced6e89433215eabe5a39f33e29ad868da483d2e1860a9a93
C:\Users\analyst\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT - b0715c24eef4c3d20c812bb858a4e50569a836f0217c7652fb350be953e5f50d
C:\Users\analyst\AppData\Roaming\Scegli_nome_allegato.exe - ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420
C:\Users\analyst\AppData\Roaming\7D57AD13E21.exe - 5e9e76c5dfa949b2140ed9acfe30a1595a3799e0b552080f2f9f051972a7f729
ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49 - ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49
0367653f24003fae1324a91b98f41caabdd5d8578a49132aa0222f02d2a106c5 - 0367653f24003fae1324a91b98f41caabdd5d8578a49132aa0222f02d2a106c5
f647ad5887b1993d77bf5e2e6ab9f8ea77328ccf8f68fb78ffae77c1d8970310 - f647ad5887b1993d77bf5e2e6ab9f8ea77328ccf8f68fb78ffae77c1d8970310

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787925112&P2=404&P3=2&P4=Te97XaSu9EfpU17tYeb5IYLGHVWRxF%2f%2bOHdE3NYvPU%2bG%2fRY8DeQBcDb9JT5PgCx2pnygiOHmAA1blQHrkTa1pw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787925187&P2=404&P3=2&P4=JlXoV8zTAlQ3UcDEwUsJNThw4u%2fDsiBTg45Vs1g8%2bcMDlPuyKCNDc5G6zii95nHo%2fIt3FylaOZtpwcXZamsVoQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

hb.za
sunray1975.zapto.org

Embedded IP addresses

52.168.117.174
52.123.252.224
48.211.4.16
4.230.171.124
52.230.59.222
74.178.76.128
20.184.175.18
20.112.250.133
40.99.133.210
52.123.128.14
40.104.4.2
74.178.76.54
4.150.223.106
57.155.104.224
52.110.12.10
52.110.12.47
203.26.79.13
74.179.77.204
135.234.160.244
52.123.252.241
74.178.232.29
52.148.114.188
72.145.35.101
92.223.78.30
52.123.252.248

File paths

B:\:t:
X:\:`:d:h:l:p:t:
X:\:`:d:h:l:p:t:x:
J:\:`:d:h:
I:\ba

More Mbrlock samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report