MALICIOUS — 0f5ba30d1e26c31bfa1f88e220fd3c919b73de3979194ca5633261cff30b9413

MALICIOUS — 0f5ba30d1e26c31bfa1f88e220fd3c919b73de3979194ca5633261cff30b9413 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Vobfus family. 6 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 0f5ba30d1e26c31bfa1f88e220fd3c919b73de3979194ca5633261cff30b9413
SHA-1: fb92f59e98b9e75a0946cb5de11c9c9b224c9cd4
MD5: 7699b22f9769900e649ce6a7fa560e27
imphash: 8880895cb88a48507ea8e143368a5314
ssdeep: 6144:EBtDib4gfGWcmsQ+/gbG0xlfPpndiVP2qoU:yDXZa+/gbGUXBdiV+E
TLSH: T10B46F7CD0B9C8484C8568B0B0C846DFDA55FEB4B382A563A608766E795E9CF770F101E
Submitted as: 0f5ba30d1e26c31bfa1f88e220fd3c919b73de3979194ca5633261cff30b9413
File type: pe · Size: 316416 bytes
Verdict: malicious (100/100) · Family: Vobfus

Detections (6 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Changeup-6169544-0
Microsoft Defender: Worm:Win32/Vobfus.FB
Emsisoft (Emergency Kit): Gen:Variant.Pronny.6
Trellix Stinger (McAfee): Trojan-FAEI!7699B22F9769
Kaspersky (KVRT): Trojan.Win32.Jorik.Vobfus.cvtk

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Trojan.Changeup-6169544-0 (rule Win.Trojan.Changeup-6169544-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 27 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

46655 behavior events · 3 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\reerio.exe - f898a197e9d58c65977261adb4a9746a4adf276f3f9d773b10278f8da5dd34b1
71150a8871db3c3380b3c6ab9571e50df94c757a3870d8889a9ba9288f689bb9 - 71150a8871db3c3380b3c6ab9571e50df94c757a3870d8889a9ba9288f689bb9
5535aaef0b04a44725a8fb63d4efdebf88187a0328bee728e3cfade9be724f79 - 5535aaef0b04a44725a8fb63d4efdebf88187a0328bee728e3cfade9be724f79

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787850674&P2=404&P3=2&P4=jniDSRP3PKWL%2fENtadEOgcgTkAveoDN%2fEMekVf%2fuC%2fnTNHkkLmbCaluWxUHP3%2fCRIISae0Kly0CSOKQq2u4dfg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787850753&P2=404&P3=2&P4=H2iD1R4xkDFaP3tcqrQsNiu8L28lkgtXpNsSSnX%2fiJtzX%2fVsIkVNWq1aOSYqvJ3p9%2fVxFf7OUSq9%2b2Z7PjIrpQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ns1.musiczipz.com
ns1.musicmixa.net
ns1.musicmixa.org
ns1.musicmixb.co
oneclient.sfx.ms

Embedded IP addresses

52.123.252.195
20.184.175.18
4.230.171.124
4.144.132.114
85.210.193.152
135.233.95.144
4.150.223.111
74.178.240.51
20.236.44.162
52.123.129.14
52.123.128.14
40.103.64.226
51.104.15.253
203.26.79.13
52.123.252.243
74.178.76.44
52.123.252.235
135.234.160.245
52.148.114.188
135.233.45.221
72.145.35.103
20.42.179.192
4.150.223.103
20.89.1.10
172.172.255.216

File paths

C:\Windows\system32\msvbvm60.dll\3
C:\Windows\system32\dx7vb.dll
C:\Program
C:\Windows\system32\MCI32.oca

More Vobfus samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report