MALICIOUS — 1fb413ec63f1dc7b71d058d53a8d78f4ac495e72e17bb7d315812b090982450b

MALICIOUS — 1fb413ec63f1dc7b71d058d53a8d78f4ac495e72e17bb7d315812b090982450b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Fileinfector family. 5 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 1fb413ec63f1dc7b71d058d53a8d78f4ac495e72e17bb7d315812b090982450b
SHA-1: b36d08a149ad777d05feb09ee46cb8c0edb9459a
MD5: 540375a45b67be3c6ab3ae5e940f318c
imphash: 895fbb56c02c3d2bca3125cef5da8730
ssdeep: 384:GTe/OmxDMmkhdQhVGqpXL9vZZsW0Z080t0M0gOzO9bxJWzes:ae2mxDMm+STZ5UW0Z080t0M0+lWys
TLSH: T1642F60D631807651EDB4F919AD00EC2DB16399A622363BD82811D5BF38B87F306C981F
Submitted as: 1fb413ec63f1dc7b71d058d53a8d78f4ac495e72e17bb7d315812b090982450b
File type: pe · Size: 33173 bytes
Verdict: malicious (99/100) · Family: Fileinfector

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Fileinfector-9834127-0
Detect It Easy (packer/type): DIE:MinGW
Microsoft Defender: Trojan:Win32/Vindor!pz
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Fileinfector-9834127-0 (rule Win.Malware.Fileinfector-9834127-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Terminates Browser, Office or Security Processes [medium] (rule tl-process-kill) - dynamic signal, weight 0.40, confidence 0.90
Contacted 57 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1622, T1082 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MinGW (rule DIE:MinGW) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, MinGW - static signal, weight 0.25, confidence 0.55
Dropped 15 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

42167 behavior events · 2 ATT&CK techniques · 28 dropped files.

Dropped files

C:\exc.exe - 0de686125d3e42bfbd739a35d8526e9554f7b0124c3ac305081aa35fb66f1718
C:\Windows\System32\dssec.dat - 45b04327bab32f25e4c8c65a63f5d7bfdf9a548c99af8594d8ce5244bb6f26c2
C:\Windows\System32\concrt140.dll - d6d809a5facaf08eb5922fb91dcfde0c7aa03a74dcdf54cce6ecaff889c25d4e
C:\Windows\setupact.log - 7163b186ef245f87880f2beb2a802cb41af72b3693ec02fef9e34ef7a760a2b5
C:\Windows\System32\license.rtf - 02d956fe50cfadf402f9a7c4992352954997de0b1af28a5e660a1edab7386ebc
C:\Windows\System32\vccorlib140.dll - 2f6a6a065144eb78e06237b7657d0496feee03f0354bbc99352061b9b685cb26
C:\Windows\System32\msvcp140.dll - d81d6ddf094e5df8ad52bb7c59aee831a0e107a2ac2cab13a1a75e204ecea6a3
C:\Windows\System32\NOISE.DAT - a54232b92779799bf0b1805c393d6776dcd7723bddc9e49826466fa921a76cb2
C:\Windows\System32\msvcp140_1.dll - 38f3f747541fa1a016dad7d7b74bd065bf0313416f5bcf2a56b2911a95372212
C:\Windows\System32\opencl.dll - d28978bf572cfd1b176d830f94d02ecf0dcfb7784248a9786a3fc15f4670511d
C:\Windows\system.ini - 5077723bea2cee1cfa1d1438b1aae55f709599e844afeb08a950bc92eae124f4
C:\Windows\Professional.xml - 3e95eecdb77db22ac5bb44efab97bf978d522386c5699e8ac214483bbaeb1161
C:\Windows\System32\vcruntime140.dll - 57867d3b0c2f56659189a12618e7d81b5cccba8041b1566c385b085e80364394
C:\Windows\System32\msvcp140_atomic_wait.dll - e7638cc034329e14307c01a4210df4ebda7b8e99365f8df15d512c588eb3d4ae
C:\Windows\DtcInstall.log - 6178926ac8136511edb96dd42f1646b093a4a59ca5f1b4149fd8ed59a14909b5

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787839886&P2=404&P3=2&P4=MlXiRYjHNGdy8c%2f%2bj0jeiyaOKYYNLGFX0aQrqgaOlVZrYuhXpiLWatut82BH5zGi19YDQoUQqICokIaIT4NydA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://www.freeav.com/
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787840001&P2=404&P3=2&P4=jJkjlb0qRBoBHVBg%2fLtoGELU%2f%2bDAGXO9BptzySrBhED%2fc4Lw16a7kYrwgl5f2ecq%2fSpsZxLMH9P30wZAWJjqWw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.freeav.com
www.avira.com
script.crazyegg.com
nexus.ensighten.com
assets.adobedtm.com
t.nc0.co
doh.cq0.co
www.webassetscdn.com
s.go-mpulse.net
widget.trustpilot.com
data.privacy.ensighten.com
dpm.demdex.net
symantec.demdex.net
symantec.tt.omtrdc.net
mhubc.avira.com
www.nortonlifelock.com
rmbyy5ra.avira.com
oms.avira.com
getrockerbox.com
www.antispyware.com
img6.wsimg.com
img1.wsimg.com
edge.fullstory.com
rs.fullstory.com
secure.quantserve.com

Embedded IP addresses

20.42.65.93
57.154.63.210
4.230.171.124
52.230.60.54
135.233.95.144
135.233.95.135
4.150.223.110
74.179.77.204
20.231.239.246
40.99.133.242
52.123.129.14
40.99.134.2
52.123.128.14
135.234.160.246
92.223.78.30
172.178.240.163
203.26.79.13
52.148.114.188
52.182.141.63
51.116.246.104
40.115.75.193
13.70.178.62
52.58.28.12
172.66.2.5
3.106.37.188

More Fileinfector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report