MALICIOUS — 10aa22f1c88b690399fa6cfe6f6f7bc1ed49d153313585fc5520621f160b64ce.exe
MALICIOUS — 10aa22f1c88b690399fa6cfe6f6f7bc1ed49d153313585fc5520621f160b64ce.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Egairtigado family. 4 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
10aa22f1c88b690399fa6cfe6f6f7bc1ed49d153313585fc5520621f160b64ce - SHA-1:
a9a0ff21db03e1cb900b0f69c078932a98ddcaf7 - MD5:
de225ab0dac2c90346c919c55e5e5bf5 - imphash:
4ba3f97ab4d7908411ad46e497198ac7 - ssdeep:
393216:psL5KSN7Nij6Oaq2b7ni6Y6oZXMCHWUjXCcuI3/PGTAI:psLkcSXZETvY60XMb8X/H/O7 - TLSH:
T1E36E33AA165F11A0D4F3E4A89C104DCD90A3B5592937D5CC8E83E86FB4D89335CF0A9B - Submitted as: 10aa22f1c88b690399fa6cfe6f6f7bc1ed49d153313585fc5520621f160b64ce.exe
- File type: pe · Size: 14296055 bytes
- Verdict: malicious (99/100) · Family: Egairtigado
Detections (4 of 52 engines)
- Hash: abuse.ch ThreatFox: known-malicious-hash
- Microsoft Defender: Trojan:Win32/Egairtigado!rfn
- Emsisoft (Emergency Kit): Gen:Variant.Yogi.14068
- Kaspersky (KVRT): HEUR:Trojan.Python.Agent.gen
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 8 weighted signals:
- Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule
known-malicious-hash) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Egairtigado!rfn (rule
Trojan:Win32/Egairtigado!rfn) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.Yogi.14068 (rule
Gen:Variant.Yogi.14068) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Python.Agent.gen (rule
HEUR:Trojan.Python.Agent.gen) - engine signal, weight 0.55, confidence 0.85 - Dropped a suspicious payload: 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153 - dynamic signal, weight 0.50, confidence 0.90
- Contacted 27 external host(s) at runtime (10 HTTP) - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1622 - dynamic signal, weight 0.40, confidence 0.75
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
2810 behavior events · 1 ATT&CK techniques · 27 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- login.live.com
- v20.events.data.microsoft.com
- desktop-hsgcbep
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- licensing.mp.microsoft.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- settings-win.data.microsoft.com
- watson.events.data.microsoft.com
- msedge.api.cdp.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
- kv801.prod.do.dsp.mp.microsoft.com
- cp801.prod.do.dsp.mp.microsoft.com
- msedge.b.tlu.dl.delivery.mp.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/6814/files/36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153 -
36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153 - /opt/CAPEv2/storage/analyses/6814/files/8d5d6d0d1d385f2164343360e6b1ad8e006b03722b00012b9b39d5c0d3de912e -
8d5d6d0d1d385f2164343360e6b1ad8e006b03722b00012b9b39d5c0d3de912e - /opt/CAPEv2/storage/analyses/6814/files/6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7 -
6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7 - /opt/CAPEv2/storage/analyses/6814/files/322ae05845a3e1b5140dfa217feaab9236be98120634308e50027be09d214d31 -
322ae05845a3e1b5140dfa217feaab9236be98120634308e50027be09d214d31 - /opt/CAPEv2/storage/analyses/6814/files/fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640 -
fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640 - /opt/CAPEv2/storage/analyses/6814/files/7e19f273192e0f5f7954e51e8799002d97bc2a480c08f6ab29d291ce79b38824 -
7e19f273192e0f5f7954e51e8799002d97bc2a480c08f6ab29d291ce79b38824 - /opt/CAPEv2/storage/analyses/6814/files/2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20 -
2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20 - /opt/CAPEv2/storage/analyses/6814/files/78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb -
78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb - /opt/CAPEv2/storage/analyses/6814/files/f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8 -
f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8 - /opt/CAPEv2/storage/analyses/6814/files/3409091d177e2718a064b876ef2ed2aaf4770d08ccb071510823d436a22d9326 -
3409091d177e2718a064b876ef2ed2aaf4770d08ccb071510823d436a22d9326 - /opt/CAPEv2/storage/analyses/6814/files/a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4 -
a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4 - /opt/CAPEv2/storage/analyses/6814/files/0a433014043122bf761f8443ee895058bc2254307d03f02387e5c40c796d955d -
0a433014043122bf761f8443ee895058bc2254307d03f02387e5c40c796d955d - /opt/CAPEv2/storage/analyses/6814/files/eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a -
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a - /opt/CAPEv2/storage/analyses/6814/files/9d18bfa31efe383333404f2509bc5dfaff27c0d2b7cf60bf762ae83ea92a886a -
9d18bfa31efe383333404f2509bc5dfaff27c0d2b7cf60bf762ae83ea92a886a - /opt/CAPEv2/storage/analyses/6814/files/4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43 -
4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
Embedded URLs
- http://schemas.microsoft.com/SMI/2016/WindowsSettings
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786214484&P2=404&P3=2&P4=Z7ysd4c0WY7dMF8XsGJxRfdQj7L29JgXMITctK9N4ublJuzePySFYTfXUC1ShWUbbrhMOXmvnbYkQNW1xT6wsg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786214550&P2=404&P3=2&P4=GWWtTqfMSZVwTDXak4SomcscxRQ1SoY2BLf0%2fmxrMB1Tgzy1S8Jso89RVWmkEz%2bGI%2bCX%2fxmU9l66StxsSPjeaA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- schemas.microsoft.com
- l.sh
- f.ir
- 6.me
- i.us
- 8.ru
Embedded IP addresses
- 20.184.175.10
- 52.230.60.54
- 4.230.171.124
- 40.84.97.4
- 135.233.45.221
- 52.123.252.197
- 74.178.232.29
- 203.26.79.13
- 184.84.165.136
- 72.145.35.101
- 20.165.94.63
- 4.150.223.104
- 4.209.250.170
- 52.148.114.188
- 52.110.12.11
- 52.110.12.47
File paths
- P:\RC
More Egairtigado samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report