MALICIOUS — 1f13e3fd99e89fbae3634a89cb84b1a5437716a4204276fb056149edf4b76630

MALICIOUS — 1f13e3fd99e89fbae3634a89cb84b1a5437716a4204276fb056149edf4b76630 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Redcap family. 7 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 1f13e3fd99e89fbae3634a89cb84b1a5437716a4204276fb056149edf4b76630
SHA-1: 0c35a0440ef6659634d2ddd3b6d717a02706b151
MD5: d10aa2db70c08d5850ff240f61440ad2
imphash: 691f1193f16065947032ace3a2329e55
ssdeep: 6144:flNgwgduvguMeOK3yNM+shFC9dLlLj0stfjSYz1Zr:fhQuvBt6NYL4dZL7rz
TLSH: T15142138062F123B2E15AC8E430935C4E46AC70C2632974E7E598BC58776D4BFBB160DD
Submitted as: 1f13e3fd99e89fbae3634a89cb84b1a5437716a4204276fb056149edf4b76630
File type: pe · Size: 214016 bytes
Verdict: malicious (99/100) · Family: Redcap

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.MPRESS1
ClamAV (daily): Win.Malware.Redcap-9828937-0
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:MPRESS
Microsoft Defender: TrojanDropper:Win32/BcryptInject.A!MTB
Emsisoft (Emergency Kit): Dropped:Trojan.Bat.AAPW
Kaspersky (KVRT): Trojan.BAT.Agent.bbn

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Redcap-9828937-0 (rule Win.Malware.Redcap-9828937-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged TrojanDropper:Win32/BcryptInject.A!MTB (rule TrojanDropper:Win32/BcryptInject.A!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dropped:Trojan.Bat.AAPW (rule Dropped:Trojan.Bat.AAPW) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.BAT.Agent.bbn (rule Trojan.BAT.Agent.bbn) - engine signal, weight 0.55, confidence 0.85
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:MPRESS (rule DIE:MPRESS) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.MPRESS1 (rule high-entropy-sections:.MPRESS1) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
Packing/obfuscation: high-entropy-sections:.MPRESS1, MPRESS - static signal, weight 0.25, confidence 0.55
Dropped 5 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

4435 behavior events · 0 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\exeD707.tmp - 28feed5f31044cbc96b185cd8ac0b12cffbc848b895ffce7d4005e25f7a8faff
C:\Users\analyst\AppData\Local\Temp\D706.tmp\icon.ico - 1b42fd6576e07141084fdc8232c8581a7d2309737ed0d219a88aacdde7c36876
C:\Users\analyst\AppData\Local\Temp\D706.tmp\mpress.exe - 7c24c72439880e502be51da5d991b9b56a1af242b4eef4737f0f43b4a87546d2
c:\users\analyst\appdata\local\temp\tsk_98f3f56a05734e98.exe.com - 450c38c19a5f858c108cd7147747a5237a502df948f3ecd4d808c0911a15e535
C:\Users\analyst\AppData\Local\Temp\CF27.tmp\vir.bat - 1f2cd31c09ccfb6968e075baa0c1d7b4d7ae106eda514d42885b97cba6ed7f95
C:\Users\analyst\AppData\Local\Temp\D706.tmp\GoRC.exe - a1de50b4d1e99c2726351eafa92454063a0047ecaa82c5927665e417b091578b
C:\Users\analyst\AppData\Local\Temp\D706.tmp\GoLink.exe - 1fa554d18490cb5e56d624cd97069f42e63800688136c6cf3c521e4ef6e83e28

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

j.pl
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.112.66
52.123.252.226
52.230.60.54
4.230.171.124
40.79.163.155
20.42.65.85
40.84.85.40
52.110.12.37
52.110.12.55
72.154.7.103
92.223.78.30
52.110.12.15
52.148.114.188
52.110.12.14

More Redcap samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report