MALICIOUS — 1ee281570175e93e3da680a3f206daecc7f43b3c902e302415d3dff3b4403355

MALICIOUS — 1ee281570175e93e3da680a3f206daecc7f43b3c902e302415d3dff3b4403355 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Gobot family. 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 1ee281570175e93e3da680a3f206daecc7f43b3c902e302415d3dff3b4403355
SHA-1: e402c9b5364ab6aae3b94b0ef706e16a50d8e866
MD5: 269b0006c406bb67ec8c4ac23c627db5
imphash: 842ba1c2436dd1a931cfdde74fd7ef17
ssdeep: 768:NiOQauOECLIK8u4qc+5aIjK4LrP+K5fE67y7N8FdUV0MeExZ6TjqEP:Nip8JB5aOLL+K5E6U878w
TLSH: T1FB338E361F2F2F1BEA7AD25788006B5E1862B8B934D54448C72FA8BD73EEC13685111D
Submitted as: 1ee281570175e93e3da680a3f206daecc7f43b3c902e302415d3dff3b4403355
File type: pe · Size: 49789 bytes
Verdict: malicious (100/100) · Family: Gobot

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:DATA
ClamAV (daily): Win.Trojan.Gobot-20
YARA: Stratosphere IPS: STRATO_IRC_Botnet
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Gen:Trojan.IRC-Backdoor.dGX@aSF4T5g
Kaspersky (KVRT): Backdoor.Win32.Delf.ma

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Trojan.Gobot-20 (rule Win.Trojan.Gobot-20) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Trojan.IRC-Backdoor.dGX@aSF4T5g (rule Gen:Trojan.IRC-Backdoor.dGX@aSF4T5g) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Delf.ma (rule Backdoor.Win32.Delf.ma) - engine signal, weight 0.55, confidence 0.85
YARA: Stratosphere IPS flagged STRATO_IRC_Botnet (rule STRATO_IRC_Botnet) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 29 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:DATA (rule high-entropy-sections:DATA) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-sections:DATA - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

242 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Windows\XNqyMmnWB.exe - 945f8c1659a062bafe01b7241344e1bec3757baba843d1e8fcfde19d1a9849b4

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

51.132.193.105
4.230.171.124
85.210.193.152
135.232.92.97
20.184.175.9
52.230.60.54
74.178.240.61
104.18.33.89
52.168.117.174
20.42.65.94
129.27.9.247
49.108.94.31
85.192.136.197
44.225.91.125
217.204.159.31
116.35.104.245
135.195.24.119
221.194.142.18
109.119.6.33
41.153.234.7
86.112.3.77
214.242.46.197
161.239.127.254
94.157.6.247
8.177.53.169

More Gobot samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report