MALICIOUS — AT-consistency-1.exe

MALICIOUS — AT-consistency-1.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Shufab family. 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 1cc1c90b3481ec8d4f3740a78f125af59ee3c9ff9e798484722e1c173a88ccd6
SHA-1: eaaf055a9f87217dc8c3e0277aabcc4fccc7aad6
MD5: 23a7236f0ffbc5b8c349ab3370b9d4c0
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 12288:5qIrEFD09leQEA49darfr3/2AbitnVYE96ltR:5AFD1A498H2D
TLSH: T16F4AD589352C0B73C36259E60574D28B8DE360A33FED262049437D76D712EDB58A2B36
Submitted as: AT-consistency-1.exe
File type: pe · Size: 460801 bytes
Verdict: malicious (98/100) · Family: Shufab

Detections (4 of 53 engines)

Microsoft Defender: Trojan:MSIL/Shufab.A!bit
Emsisoft (Emergency Kit): Gen:Variant.msilheracles.128405
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
Trellix Stinger (McAfee): Packed-VL!23A7236F0FFB

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 11 weighted signals:

Microsoft Defender flagged Trojan:MSIL/Shufab.A!bit (rule Trojan:MSIL/Shufab.A!bit) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.msilheracles.128405 (rule Gen:Variant.msilheracles.128405) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Extracted AgentTesla config (0 C2) - engine signal, weight 0.45, confidence 0.60
Extracted AgentTesla config (0 C2) - engine signal, weight 0.45, confidence 0.60
Embedded network infrastructure: 6.9.1.5, 17.18.7.0 - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

7170 behavior events · 2 ATT&CK techniques · 12 dropped files.

Dropped files

698e4a149b91171dc805fc18bb8ab4ac0e461e6ca25e04996b1b6232cdb9f76e - 698e4a149b91171dc805fc18bb8ab4ac0e461e6ca25e04996b1b6232cdb9f76e
3daa93b22601ecf778176338b1b5d845584cb99a8d67b2d0d224a64eeaad30b6 - 3daa93b22601ecf778176338b1b5d845584cb99a8d67b2d0d224a64eeaad30b6
3ee8acf49be6d718f214e22396cca984b869e64fa82980246cadcbb7e2c79556 - 3ee8acf49be6d718f214e22396cca984b869e64fa82980246cadcbb7e2c79556
f75668726b340746fd9d90a536e043500a8b125283c2468293d656395e30a6e1 - f75668726b340746fd9d90a536e043500a8b125283c2468293d656395e30a6e1
d60664e94eb24367afa079a2ca42f67011a669f37149448082d033a73135eddb - d60664e94eb24367afa079a2ca42f67011a669f37149448082d033a73135eddb
ec875f9feb237e9e9e44f8b31e1463eda38863fd5394a09952aa3d0e221740fc - ec875f9feb237e9e9e44f8b31e1463eda38863fd5394a09952aa3d0e221740fc
de2a0403854c6bc7b7216269fc08ec7dd56548d01961982d9d6318ee7d9d138c - de2a0403854c6bc7b7216269fc08ec7dd56548d01961982d9d6318ee7d9d138c
c0f662861339f5b274ed450f9ba38f81cc847dc8fbc8547e971f46de854bdd5c - c0f662861339f5b274ed450f9ba38f81cc847dc8fbc8547e971f46de854bdd5c
d2d41be8d455bf58cceb419baf1ea5553e9825755aeb4caac91afe321c05987f - d2d41be8d455bf58cceb419baf1ea5553e9825755aeb4caac91afe321c05987f
1c640ab7e5c5d8eff0b01c0333adf7284d0fbe751c69b33545edadd8a039fecf - 1c640ab7e5c5d8eff0b01c0333adf7284d0fbe751c69b33545edadd8a039fecf
14bdcb3dfae1adf59138170b6eed571c837256a7dcc39e0e97ac53449909fe98 - 14bdcb3dfae1adf59138170b6eed571c837256a7dcc39e0e97ac53449909fe98
53361fbf96d05e816c0e1eaae7b97e0c6b2f6564a5a6d2a3e1d305d30b0630d8 - 53361fbf96d05e816c0e1eaae7b97e0c6b2f6564a5a6d2a3e1d305d30b0630d8

Embedded domains

searchapp.bundleassets.example
checkip.dyndns.org
www.msftconnecttest.com
config.edge.skype.com
dns.msftncsi.com
fd.api.iris.microsoft.com
aps.prod.windows.com
www.bing.com
tas02.sls.update.microsoft.com
to-do.microsoft.com
settings-win.data.microsoft.com
ctldl.windowsupdate.com
edge.microsoft.com

Embedded IP addresses

6.9.1.5
17.18.7.0

More Shufab samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report