SUSPICIOUS — 15e09fec690f876640384f5e35e7900d80187b0b74bd1986a304511fec8a6e43

SUSPICIOUS — 15e09fec690f876640384f5e35e7900d80187b0b74bd1986a304511fec8a6e43 is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (47/100), attributed to the Kryptik family. 1 of 56 detection engines flagged it.

Identification

• SHA-256: 15e09fec690f876640384f5e35e7900d80187b0b74bd1986a304511fec8a6e43
• SHA-1: 20c9d66e3d7a35619499ed4b1a78b79f92c8115a
• MD5: 6c4e20e94f42240370926e8ab8fcfab8
• imphash: 06fa6e7514785260c20b40b4d89595d8
• ssdeep: 6144:4fT2bOFQuF3uBLttPIw+vg3plgZFhDamR4XOyV5R7LZPS0tnO:CT2bUQuxuBcw+CpSZFImR4BVH7L9tnO
• TLSH: T195486B6120033212E9F6FE44AE104DDDC827B469663329DE920BE49F91E47B3C6F55B2
• Submitted as: 15e09fec690f876640384f5e35e7900d80187b0b74bd1986a304511fec8a6e43
• File type: pe · Size: 381849 bytes
• Verdict: suspicious (47/100) · Family: Kryptik

Detections (1 of 56 engines)

• Kaspersky (KVRT): HEUR:Trojan.Win64.Kryptik.gen

Why this verdict

The suspicious score of 47/100 is the fusion of 1 weighted signal:

• Kaspersky (KVRT) flagged HEUR:Trojan.Win64.Kryptik.gen (rule HEUR:Trojan.Win64.Kryptik.gen) - engine signal, weight 0.55, confidence 0.85

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• licensing.mp.microsoft.com
• config.edge.skype.com
• windows.msn.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• assets.msn.com
• www.bing.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• www.msftconnecttest.com/connecttest.txt

Embedded URLs

• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• www.microsoft.com
• crl.microsoft.com

Embedded IP addresses

• 52.168.117.175
• 20.247.184.197
• 52.123.252.240
• 4.230.171.124
• 52.110.12.56
• 52.110.12.2

More Kryptik samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report