MALICIOUS — photov_351499307841.lnk

MALICIOUS — photov_351499307841.lnk is a lnk sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the Ravartar family. 3 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 159575c757cedd859acc08f2c0029c0279e663c48dee4c102d7e4d040a4ccf97
• SHA-1: 92f98ad8f400d55aa0616138fd4cb4e819d81e69
• MD5: b4fee9c2b37cb671521c47e62b9a85c8
• ssdeep: 24:8m+Oj11Ln7H6rWHIQXn6JNqCUd4I0wVmOV4I0+udvNx7:8aH6aHIYnoNqCUCImOqIwNd
• TLSH: T1EC168BCE076C0B25D375C5988131E5EF4E9AE03904FD6A2B4F1A983A4103517EDE39B6
• Submitted as: photov_351499307841.lnk
• File type: lnk · Size: 2796 bytes
• Verdict: malicious (94/100) · Family: Ravartar

Detections (3 of 51 engines)

• Microsoft Defender: Trojan:Win32/Ravartar!rfn
• Emsisoft (Emergency Kit): Trojan.Generic.40346832
• Kaspersky (KVRT): HEUR:Trojan.WinLNK.Agent.gen

MITRE ATT&CK

• T1543.003
• T1112

Why this verdict

The malicious score of 94/100 is the fusion of 6 weighted signals:

• Microsoft Defender flagged Trojan:Win32/Ravartar!rfn (rule Trojan:Win32/Ravartar!rfn) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Generic.40346832 (rule Trojan.Generic.40346832) - engine signal, weight 0.55, confidence 0.85
• Shortcut launches: powershell - static signal, weight 0.50, confidence 0.80
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

24641 behavior events · 2 ATT&CK techniques · 8 dropped files.

Runtime network

• none

Dropped files

• /opt/CAPEv2/storage/analyses/5740/files/ca126c4c630d761256043d028fdee5cd1584856b1afe8346f240142467d17b67 - ca126c4c630d761256043d028fdee5cd1584856b1afe8346f240142467d17b67
• /opt/CAPEv2/storage/analyses/5740/files/96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
• /opt/CAPEv2/storage/analyses/5740/files/500294a0e4464b4b030a2461cc3ac97e09ff59787be168b6e8421e81137d04ef - 500294a0e4464b4b030a2461cc3ac97e09ff59787be168b6e8421e81137d04ef
• 8711a363ce3ea585aceae6f46450ac78afb69632d67a7f4c5baa4c5850d109e1 - 8711a363ce3ea585aceae6f46450ac78afb69632d67a7f4c5baa4c5850d109e1
• b14dd4276bc6629bbe6d704e584c3102bf3c0ffbab5e7b5973564b275c6b53b1 - b14dd4276bc6629bbe6d704e584c3102bf3c0ffbab5e7b5973564b275c6b53b1
• dfab36e61692a2438b5ec9cf85029190c64e963ebdfe60dec7f4837f6e186bd5 - dfab36e61692a2438b5ec9cf85029190c64e963ebdfe60dec7f4837f6e186bd5
• ed052eea7b7e01edee7cfc11f6651072317f90d5d4ae2e2aa0ea3714dc5836ea - ed052eea7b7e01edee7cfc11f6651072317f90d5d4ae2e2aa0ea3714dc5836ea
• 6d74539e1f06c5786037a42e52d9c5ce67a76d6effa038d7a2bddc647f8cd555 - 6d74539e1f06c5786037a42e52d9c5ce67a76d6effa038d7a2bddc647f8cd555

More Ravartar samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report