MALICIOUS — 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887

MALICIOUS — 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the AutoIt family. 6 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887
SHA-1: d47f6f7e553c4bc44a2fe88c2054de901390b2d7
MD5: e0340f456f76993fc047bc715dfdae6a
imphash: 15a03c4004dba3b33cca833f8d37134e
ssdeep: 24576:/4GHnhIzOasqUgEOr69/BRH7dCibu+XoAX0eOTva49ttrSpt81ekHPyWe:AshdasJgEOrGBRxCihH7OO49rveMG
TLSH: T1535523E46BE6584FF428AA165F87849FC2AA5807861F6034B3C8F7773D99B4320345E1
Submitted as: 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887
File type: pe · Size: 1246725 bytes
Verdict: malicious (99/100) · Family: AutoIt

Detections (6 of 51 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): {MD5}bin.dropper.autit.7325.UNOFFICIAL
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:AutoIt
Microsoft Defender: Ransom:AutoIt/RedBoot!rfn
Emsisoft (Emergency Kit): Trojan.Ransom.Autoit.A

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged {MD5}bin.dropper.autit.7325.UNOFFICIAL (rule {MD5}bin.dropper.autit.7325.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Ransom:AutoIt/RedBoot!rfn (rule Ransom:AutoIt/RedBoot!rfn) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Ransom.Autoit.A (rule Trojan.Ransom.Autoit.A) - engine signal, weight 0.55, confidence 0.85
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:AutoIt (rule DIE:AutoIt) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 3.3.14.2 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, AutoIt - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

15910 behavior events · 1 ATT&CK techniques · 14 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/5638/files/434d90cbef1e47f051831954cff802db2b0fddc8c7298d2ced3280cfd6dd5f8c - 434d90cbef1e47f051831954cff802db2b0fddc8c7298d2ced3280cfd6dd5f8c
/opt/CAPEv2/storage/analyses/5638/files/0c5f0099689957b04cbb070d66d114109085e55339ce57857d473b7122407544 - 0c5f0099689957b04cbb070d66d114109085e55339ce57857d473b7122407544
/opt/CAPEv2/storage/analyses/5638/files/2a5305369edb9c2d7354b2f210e91129e4b8c546b0adf883951ea7bf7ee0f2b2 - 2a5305369edb9c2d7354b2f210e91129e4b8c546b0adf883951ea7bf7ee0f2b2
/opt/CAPEv2/storage/analyses/5638/files/f623341460b1346a4afe71e0beebd3b8574a87fa7862519d3ca9117ea0a150b1 - f623341460b1346a4afe71e0beebd3b8574a87fa7862519d3ca9117ea0a150b1
/opt/CAPEv2/storage/analyses/5638/files/5e89205ade776c0b38c1929d0eac8d91eaccf1158bac61a3cb6aaafac6ab4af6 - 5e89205ade776c0b38c1929d0eac8d91eaccf1158bac61a3cb6aaafac6ab4af6
/opt/CAPEv2/storage/analyses/5638/files/8301e344371b0753d547b429c5fe513908b1c9813144f08549563ac7f4d7da68 - 8301e344371b0753d547b429c5fe513908b1c9813144f08549563ac7f4d7da68
/opt/CAPEv2/storage/analyses/5638/files/b287b639f6edd612f414caf000c12ba0555adb3a2643230cbdd5af4053284978 - b287b639f6edd612f414caf000c12ba0555adb3a2643230cbdd5af4053284978
/opt/CAPEv2/storage/analyses/5638/files/88856962cef670c087eda4e07d8f78465beeabb6143b96bd90f884a80af925b4 - 88856962cef670c087eda4e07d8f78465beeabb6143b96bd90f884a80af925b4
/opt/CAPEv2/storage/analyses/5638/files/86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2 - 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
/opt/CAPEv2/storage/analyses/5638/files/cafec240d998e4b6e92ad1329cd417e8e9cbd73157488889fd93a542de4a4844 - cafec240d998e4b6e92ad1329cd417e8e9cbd73157488889fd93a542de4a4844
/opt/CAPEv2/storage/analyses/5638/files/6bc234f5e2a305ae66950411dcded272f093ab1f6f688595b3a062e6bf84e8e3 - 6bc234f5e2a305ae66950411dcded272f093ab1f6f688595b3a062e6bf84e8e3
/opt/CAPEv2/storage/analyses/5638/files/b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3 - b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3
/opt/CAPEv2/storage/analyses/5638/files/4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026 - 4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
c8584553197e1436e0aaac7994d615fc0856cc709e8c4d28da339a6de8cc1954 - c8584553197e1436e0aaac7994d615fc0856cc709e8c4d28da339a6de8cc1954

Embedded domains

inference.location.live.net

Embedded IP addresses

3.3.14.2

More AutoIt samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report