MALICIOUS — 13e2acc8ee69c8d1cd91b8bf1967f56a5b4ac5ab6849658cd3e04ed086387667

MALICIOUS — 13e2acc8ee69c8d1cd91b8bf1967f56a5b4ac5ab6849658cd3e04ed086387667 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Bublik family. 6 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 13e2acc8ee69c8d1cd91b8bf1967f56a5b4ac5ab6849658cd3e04ed086387667
SHA-1: 12dd16f0c255eb82dbe32a1a5bbb7ffa82d600fa
MD5: 5be6e8a5266c521859642f9c9e48539b
imphash: ae2cb3b121f245e201e8e28507c72714
ssdeep: 384:zmQAY03ckaC1UAOh+xMR5QYKZseH5dy8AOgY:zTAiYUVaQDKVFFgY
TLSH: T1AC2C44BD489B091BC2A110B59631838D2B5F70CF2ADABA19870A403CAFF14D39DF1657
Submitted as: 13e2acc8ee69c8d1cd91b8bf1967f56a5b4ac5ab6849658cd3e04ed086387667
File type: pe · Size: 25294 bytes
Verdict: malicious (100/100) · Family: Bublik

Detections (6 of 56 engines)

ClamAV (daily): Win.Trojan.Bublik-13
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Astaroth.psyW!MTB
Emsisoft (Emergency Kit): Trojan.Downloader.JQAN
Trellix Stinger (McAfee): PWSZbot-FDQ!5BE6E8A5266C
Kaspersky (KVRT): Trojan.Win32.Bublik.bdjb

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Trojan.Bublik-13 (rule Win.Trojan.Bublik-13) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Astaroth.psyW!MTB (rule Trojan:Win32/Astaroth.psyW!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Downloader.JQAN (rule Trojan.Downloader.JQAN) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PWSZbot-FDQ!5BE6E8A5266C (rule PWSZbot-FDQ!5BE6E8A5266C) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Bublik.bdjb (rule Trojan.Win32.Bublik.bdjb) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

13370 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\fcbnaf.exe - 87fdd25ce07f4dee0c5a495f6eb694dab1eaea89035575e435f841e1e3babb5a
fb85391fce5f24b8a4f531e3dddf4a0fe6d6885e28c24d204b1e38824b0f2f7d - fb85391fce5f24b8a4f531e3dddf4a0fe6d6885e28c24d204b1e38824b0f2f7d
0e7e8e9ff9202bf2f1f15c22894387740df575d56c6b979ba83cd58022e37baa - 0e7e8e9ff9202bf2f1f15c22894387740df575d56c6b979ba83cd58022e37baa

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

aefd.nelreports.net
huyontop.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.17
52.230.59.222
4.230.171.124
135.232.92.97
172.215.188.232
135.233.95.144
104.18.33.89
52.110.12.33
52.110.12.25
57.155.101.212
135.233.45.223
72.145.35.98
52.148.114.188
52.110.12.37

File paths

C:\Users\Stephen
Q:\259\EXE\96f8a50178f30da347f8846677401c2b
C:\LFb67LKX.exe
C:\vn5sEFJn.exe
C:\GwVNmm35.exe
C:\aPIrnIeQ.exe
C:\YqESLpKe.exe
C:\ZvyO5VdW.exe
C:\3_zLwjIv.exe
C:\1gmFO5VT.exe
C:\Users\maxine\AppData\Local\Temp\file.exe
C:\Users\admin\Downloads\48b15de35c1fd609d07973b0d8c85eb5.virus.exe
C:\078d57640eab010aad222f09d98952174ff111932e2cc8cb60d2654d4d76d720
C:\06436bb036b51f40d7163c4eb5ba91539cf97e20417ce21a3368a8e87add210e
C:\99189db99884bab709a5b342f322ab5e0ac7b786805c092ff2170a7e18ff40ef
C:\Users\george\Desktop\fcbnaf.exe
C:\Users\admin\Downloads\fcbnaf.exe
C:\Users\Administrator\AppData\Local\Temp\tTbs.exe
C:\b5975b9f228749e4cbe2f0774399dc514813b9764423e6753150da5fa7e41368
C:\3227989dd39e6137bdba6abd64a145982a27fc502e5a4e7a8e6f0bb085ca5499
C:\eb4fd4ddf01a7a7d8995d359d37ce30ca94724571aade6a282590b878c882f56
C:\c47f6214daf8ea8876f3316067ac568a8646e668b7d6e9860aec048697b45f1c
C:\e43a0e97ce72fb9fad75e5e5ad33675ca75b6c962cecc5f1e5c5b631c23e79b6
C:\8ed02c11f906a30a749b51fb8e605d33512dbbcc17156c7062fab8a087bfae14
C:\d792fbce777cde704b9a4e56a35f3c4fecc7665163b950d8ade773bc67a04994

More Bublik samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report