MALICIOUS — 11b4adf38547abc1c29236d077ffaeb98a02585f96aa9f45a7139bcdcff501f9

MALICIOUS — 11b4adf38547abc1c29236d077ffaeb98a02585f96aa9f45a7139bcdcff501f9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Botgor family. 7 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 11b4adf38547abc1c29236d077ffaeb98a02585f96aa9f45a7139bcdcff501f9
• SHA-1: 9bf921efdaab63388b2afa49f9de2fdfd774e549
• MD5: 7fe8140e5f72c020ad0ec0d2a6bd8b16
• imphash: 79b96456f9efc94c33ade5e8ec421b2f
• ssdeep: 1536:6+gisi/OTW1bk3FwErVvHcTWBignpwLsO9NXw6dcal:6IZ1bk1FVvHcTgO4O9fcal
• TLSH: T11D385AE97A262361F5B2CF4A88514E0D8073E1BD25A2101D8AD3C77D2F39CDB887E195
• Submitted as: 11b4adf38547abc1c29236d077ffaeb98a02585f96aa9f45a7139bcdcff501f9
• File type: pe · Size: 83456 bytes
• Verdict: malicious (97/100) · Family: Botgor

Detections (7 of 52 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• ClamAV (daily): Win.Malware.Botgor-9853222-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
• Microsoft Defender: Backdoor:Win32/Botgor.B
• Emsisoft (Emergency Kit): Win32.Backdoor.Agent.A
• Kaspersky (KVRT): Worm.Win32.Burn.b

MITRE ATT&CK

• T1055

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 97/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Win.Malware.Botgor-9853222-0 (rule Win.Malware.Botgor-9853222-0) - engine signal, weight 0.90, confidence 0.95
• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

File paths

• C:\MyRep.dat

More Botgor samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report