MALICIOUS — 19cb8df79a83dfc143d131c5c5f0f4e4b46684424381ed9b828374855845b8ea

MALICIOUS — 19cb8df79a83dfc143d131c5c5f0f4e4b46684424381ed9b828374855845b8ea is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Phoenix family. 8 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 19cb8df79a83dfc143d131c5c5f0f4e4b46684424381ed9b828374855845b8ea
SHA-1: 2fea9e2a2d20dff91530f48afeae99753d79a999
MD5: 4a2ebdda2e3f397559ac0331a2b74e89
imphash: 535aa53b75f6d88786401b3ce980eabf
ssdeep: 98304:zVuouKwEWXhyjn/v4+OQC/qSGLzm3I9meXLky5ozLhqmIUtn:3YEWXhe/mQgqSIzIIceXLkhha
TLSH: T18E6523D17051FF81EB1AA8900072947F6463EB87279AA175F2C4D1329AD05BBE610BFC
Submitted as: 19cb8df79a83dfc143d131c5c5f0f4e4b46684424381ed9b828374855845b8ea
File type: pe · Size: 5868032 bytes
Verdict: malicious (99/100) · Family: Phoenix

Detections (8 of 55 engines)

capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
ClamAV (daily): Win.Dropper.Detected-9965175-0
YARA: Yara-Rules community: YR_Packer_VMProtect
Detect It Easy (packer/type): DIE:VMProtect
Microsoft Defender: PWS:MSIL/Phoenix!pz
Emsisoft (Emergency Kit): Trojan.Generic.31199861
Kaspersky (KVRT): UDS:Trojan-PSW.Win32.Stealer

MITRE ATT&CK

T1056.001

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Dropper.Detected-9965175-0 (rule Win.Dropper.Detected-9965175-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. RWX/private injected region in tsk_115c3194fb (pid 3360) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 26 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
Extracted Alfonso config (0 C2) - engine signal, weight 0.45, confidence 0.60
YARA: Yara-Rules community flagged YR_Packer_VMProtect (rule YR_Packer_VMProtect) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:VMProtect (rule DIE:VMProtect) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Themida/VMProtect, high-entropy-sections:.vmp1, VMProtect - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

2633 behavior events · 0 ATT&CK techniques · 2 dropped files.

Dropped files

947407f54caa120f0b685f0b107efa9c7010ed264a8291011422c1475f8547e0 - 947407f54caa120f0b685f0b107efa9c7010ed264a8291011422c1475f8547e0
39a6c77be8d21ee788853eacff424c6d8524ee1e31f37798b6611d25664f943b - 39a6c77be8d21ee788853eacff424c6d8524ee1e31f37798b6611d25664f943b

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787764019&P2=404&P3=2&P4=bW%2favtgDFAN0dSaBI8E%2b%2fJMP5bCOuH6YiTyEbceJWyzwUoCR4xvroxH89ehzLaJGuc6bpdcykvU16TLQx%2bmgNQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

j.pl
f.se
z.fr
e.to

Embedded IP addresses

20.184.175.19
52.123.252.244
4.230.171.124
48.211.4.16
57.154.63.210
52.230.59.222
135.233.95.144
20.165.94.54
4.150.223.114
20.236.44.162
40.99.133.242
52.123.129.14
20.52.64.201
172.178.240.163
20.52.64.200
52.123.252.235
92.223.78.30
203.26.79.13
52.148.114.188
52.123.252.247
135.233.95.80
52.123.252.229
52.110.12.49
52.110.12.32
72.145.35.109

File paths

n:\eU
Q:\t

More Phoenix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report