MALICIOUS — 15b3b4276671655b9312a45d0f6a4edbaeb99379f2a4e2b4e39ec8ca2c8d3ada

MALICIOUS — 15b3b4276671655b9312a45d0f6a4edbaeb99379f2a4e2b4e39ec8ca2c8d3ada is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Aej6tal family. 6 of 56 detection engines flagged it.

Identification

SHA-256: 15b3b4276671655b9312a45d0f6a4edbaeb99379f2a4e2b4e39ec8ca2c8d3ada
SHA-1: b786070ee9ea7b5e1a7b371d158d92e3399b90f2
MD5: 011d9ab8b4028c14a0a51fa0a7834c5a
imphash: 94b80db415f18a81da9bc109bfe9df14
ssdeep: 1536:kF0M5BTkYTU/ETOw5trcre4WaIPQ0Mnugmb:aPBSMTOutYJfjnujb
TLSH: T16C3AAE139133700BF252F750BE91DE5C683725E7AE288587AB879E5FA8D94A3342C11C
Submitted as: 15b3b4276671655b9312a45d0f6a4edbaeb99379f2a4e2b4e39ec8ca2c8d3ada
File type: pe · Size: 98696 bytes
Verdict: malicious (99/100) · Family: Aej6tal

Detections (6 of 56 engines)

ClamAV (daily): Win.Malware.Aej6tal-9939229-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: Backdoor:Win32/Zegost.CQ!bit
Emsisoft (Emergency Kit): Gen:Variant.Farfli.66
Kaspersky (KVRT): UDS:Backdoor.Win32.Lotok.fkc

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Aej6tal-9939229-0 (rule Win.Malware.Aej6tal-9939229-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Backdoor:Win32/Zegost.CQ!bit (rule Backdoor:Win32/Zegost.CQ!bit) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Farfli.66 (rule Gen:Variant.Farfli.66) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Backdoor.Win32.Lotok.fkc (rule UDS:Backdoor.Win32.Lotok.fkc) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

73 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

cfe02a372dde4a04b8a9caf3ba402de0c4a41ef15f17d7d43c252609ffdd52b6 - cfe02a372dde4a04b8a9caf3ba402de0c4a41ef15f17d7d43c252609ffdd52b6

Embedded URLs

http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/windows0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.microsoft.com
www.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.97
52.123.252.248
4.230.171.124
20.247.184.142
85.210.193.152
57.154.63.210
135.232.92.97
20.42.65.84
74.178.240.61
4.150.223.112
172.64.154.167
74.178.76.128
92.223.78.30
52.110.12.30
52.110.12.49
172.215.188.225
52.168.117.170
20.42.65.91
52.148.114.188
72.154.7.17
52.110.12.2

More Aej6tal samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report