MALICIOUS — 1cf51799c20dc75e08c3544dc9a39201c80dd0b1be7087f0e037d98883bfb530

MALICIOUS — 1cf51799c20dc75e08c3544dc9a39201c80dd0b1be7087f0e037d98883bfb530 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Padodor family. 5 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 1cf51799c20dc75e08c3544dc9a39201c80dd0b1be7087f0e037d98883bfb530
• SHA-1: cbd6a7cc90eab600ba4f7e0acba3265acdcac102
• MD5: 822a3b6d9a83666f59ef91e7040e850b
• imphash: 26babd76bbb7f9c516a338b0601b4c9f
• ssdeep: 1536:c9BnFq4V0zYGCubdF5YykEyBNy++5OMP1MfO:dvzBZFSyoBAz1MfO
• TLSH: T149385AFDEA05D087DFBC064C0551B13C63BD39F12B66E2D878E8E80A99B9D07CA40129
• Submitted as: 1cf51799c20dc75e08c3544dc9a39201c80dd0b1be7087f0e037d98883bfb530
• File type: pe · Size: 77824 bytes
• Verdict: malicious (99/100) · Family: Padodor

Detections (5 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
• ClamAV (daily): Win.Trojan.Crypted-29
• Microsoft Defender: Backdoor:Win32/Padodor.SK!MTB
• Emsisoft (Emergency Kit): Trojan.GenericKDZ.119632
• Kaspersky (KVRT): Backdoor.Win32.Padodor.gen

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Crypted-29 (rule Win.Trojan.Crypted-29) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Backdoor:Win32/Padodor.SK!MTB (rule Backdoor:Win32/Padodor.SK!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.119632 (rule Trojan.GenericKDZ.119632) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Backdoor.Win32.Padodor.gen (rule Backdoor.Win32.Padodor.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

6733 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• wpad
• 10.240.0.1
• 57.155.104.224 SG · Singapore · AS8075 Microsoft Limited UK

Embedded domains

• zp.jp

Embedded IP addresses

• 57.155.104.224

More Padodor samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report