MALICIOUS — virussign.com_bf0fd655fc94790e2b8c717a05b64990.vir

MALICIOUS — virussign.com_bf0fd655fc94790e2b8c717a05b64990.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Convagent family. 9 of 53 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

• SHA-256: 1f3da73448aa167f3586e31133563fbb3ce99d938d016911508d4838cf06979f
• SHA-1: 06cdb28e8155587b2d7b83c01b0d66c75e098090
• MD5: bf0fd655fc94790e2b8c717a05b64990
• imphash: 14b4507f976e32ec2f82aea1cd56dda1
• ssdeep: 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3p:CebAjOKn3wRKRJ3p
• TLSH: T1E65E9D5240037232D1F6ED59E821C8EDC437B85895718E8D924BEE5F91ED337AAE00B9
• Submitted as: virussign.com_bf0fd655fc94790e2b8c717a05b64990.vir
• File type: pe · Size: 2869837 bytes
• Verdict: malicious (99/100) · Family: Convagent

Detections (9 of 53 engines)

• capa (capabilities): capability:credential-access
• MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Trellix/McAfee ATR: ATR_REvil_Sodinokibi
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Detect It Easy (packer/type): DIE:Microsoft Linker
• Microsoft Defender: Trojan:Win64/Convagent.AHE!MTB
• Emsisoft (Emergency Kit): Trojan.GenericKD.80791825
• Kaspersky (KVRT): HEUR:Trojan.Win64.Agent.pef

MITRE ATT&CK

• T1555
• T1003
• T1056.001
• T1543.003
• T1112

Why this verdict

The malicious score of 99/100 is the fusion of 15 weighted signals:

• Microsoft Defender flagged Trojan:Win64/Convagent.AHE!MTB (rule Trojan:Win64/Convagent.AHE!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.GenericKD.80791825 (rule Trojan.GenericKD.80791825) - engine signal, weight 0.55, confidence 0.85
• access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• Contacted 20 external host(s) at runtime (2 HTTP) - network signal, weight 0.40, confidence 0.80
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: Trellix/McAfee ATR flagged ATR_REvil_Sodinokibi (rule ATR_REvil_Sodinokibi) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://docs.rs/getrandom#nodejs-es-module-support!dangling, 20.19.18.17, 16.15.14.13 - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

17780 behavior events · 2 ATT&CK techniques · 4 dropped files.

Runtime network

• www.msftconnecttest.com
• inference.location.live.net
• journalist-ae.blog
• http://www.msftconnecttest.com/connecttest.txt
• http://203.26.79.13/filestreamingservice/files/15f5d388-aefb-49dc-ba9c-bc58b098ac43?P1=1785380283&P2=404&P3=2&P4=D46CEEFtrsyl5RDbtzVgpPLHeJzhZq4jKfnJYrUEhx6Cq5fQH4ciWZ8vGpp9EUSexC8y6YRs8NXQK3b8KzWN0g%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
• 23.40.52.209
• 4.150.223.99
• 20.190.167.148
• 150.171.22.17
• 23.33.238.178
• 52.110.12.2
• 4.230.171.124
• 23.33.238.207
• 4.144.132.114
• 172.178.240.161
• 172.67.214.31
• 150.171.109.24
• 135.234.160.244
• 199.232.138.172
• 20.42.179.192

Dropped files

• /opt/CAPEv2/storage/analyses/5474/files/a35a35a55cbf4920415ef3d9a33014856204501e4c731b105297a97314558fab - a35a35a55cbf4920415ef3d9a33014856204501e4c731b105297a97314558fab
• /opt/CAPEv2/storage/analyses/5474/files/c57286ef2d0444844508c3eb42845565483b123761a5ea6e1a741b3c8b194ef2 - c57286ef2d0444844508c3eb42845565483b123761a5ea6e1a741b3c8b194ef2
• /opt/CAPEv2/storage/analyses/5474/files/229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb - 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
• 5ebbbddf9d66245eb99011e5839b1d619f031798d2dc388950363241dff43989 - 5ebbbddf9d66245eb99011e5839b1d619f031798d2dc388950363241dff43989

Embedded URLs

• https://docs.rs/getrandom#nodejs-es-module-support!dangling
• http://www.msftconnecttest.com/connecttest.txt
• http://203.26.79.13/filestreamingservice/files/15f5d388-aefb-49dc-ba9c-bc58b098ac43?P1=1785380283&P2=404&P3=2&P4=D46CEEFtrsyl5RDbtzVgpPLHeJzhZq4jKfnJYrUEhx6Cq5fQH4ciWZ8vGpp9EUSexC8y6YRs8NXQK3b8KzWN0g%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

• index.crates.io
• socket.io
• engine.io
• docs.rs
• inference.location.live.net
• journalist-ae.blog

Embedded IP addresses

• 20.19.18.17
• 16.15.14.13
• 23.40.52.209
• 4.150.223.99
• 20.190.167.148
• 150.171.22.17
• 23.33.238.178
• 52.110.12.2
• 4.230.171.124
• 23.33.238.207
• 4.144.132.114
• 172.178.240.161
• 172.67.214.31
• 150.171.109.24
• 135.234.160.244
• 199.232.138.172
• 20.42.179.192
• 72.147.149.16
• 23.221.133.185
• 51.132.193.105
• 203.26.79.13
• 23.221.133.123

File paths

• C:\Users\corni\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\nokhwa-core-0.1.8\src\types.rs
• C:\Users\corni\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rust_engineio-0.5.0\src\asynchronous\client\builder.rs
• C:\Users\corni\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rust_socketio-0.5.0\src\asynchronous\client\client.rs
• C:\Users\corni\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rust_socketio-0.5.0\src\asynchronous\client\builder.rs
• C:\Users\corni\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-tungstenite-0.20.1\src\tls.rs
• C:\Users\corni\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-tungstenite-0.20.1\src\connect.rs
• C:\Users\corni\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\std\src\thread\functions.rs
• C:\Users\corni\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mozjpeg-0.10.13\src\decompress.rs
• C:\Users\corni\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.149\src\value\ser.rs
• C:\Users\corni\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rusqlite-0.31.0\src\lib.rs
• C:\Users\corni\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rusqlite-0.31.0\src\raw_statement.rs
• C:\Users\corni\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rusqlite-0.31.0\src\cache.rs
• C:\Users\corni\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\nokhwa-core-0.1.8\src\pixel_format.rs
• C:\Users\corni\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\anyhow-1.0.100\src\fmt.rs
• C:\Users\corni\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\anyhow-1.0.100\src\error.rs
• C:\Users\corni\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.21.7\src\engine\general_purpose\mod.rs
• C:\Users\corni\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.21.7\src\engine\general_purpose\decode_suffix.rs
• C:\Users\corni\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.21.7\src\engine\general_purpose\decode.rs
• C:\Users\corni\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.11.0\src\lib.rs
• C:\Users\corni\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\std\src\sync\mpmc\mod.rs
• C:\Users\corni\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\std\src\sync\mpmc\list.rs
• C:\Users\corni\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\std\src\sync\mpmc\zero.rs
• C:\Users\corni\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\std\src\sync\mpmc\array.rs
• C:\Users\corni\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\std\src\sync\mpmc\waker.rs
• C:\Users\corni\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\std\src\sync\mpmc\context.rs

More Convagent samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report