MALICIOUS — 1fb58e074b2a2cd302963bd41ae19abb347af95e18f0ed9d55b1fc1b39f9e3eb

MALICIOUS — 1fb58e074b2a2cd302963bd41ae19abb347af95e18f0ed9d55b1fc1b39f9e3eb is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Shifu family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 1fb58e074b2a2cd302963bd41ae19abb347af95e18f0ed9d55b1fc1b39f9e3eb
SHA-1: f8e058d9a649276503dfd5325eb5aef4585b6e06
MD5: fb40ab9e69d770c6abf64328b61a4b79
imphash: 29c4c5f8766667965cf6248336ce2ba0
ssdeep: 3072:RW/Qc+sSxnTrGadgsFqZeo4pwkhUmZr3hPsOraS87FYqjTZbn4TG:RW/2sSxTrGvsFUejWyZr3hPswa1TZjx
TLSH: T13C401267A5102BCECD8EC7209C01428F9269638633F1EAD40517C2B6F878D93D7DA657
Submitted as: 1fb58e074b2a2cd302963bd41ae19abb347af95e18f0ed9d55b1fc1b39f9e3eb
File type: pe · Size: 168448 bytes
Verdict: malicious (100/100) · Family: Shifu

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Gamarue-9832405-0
Microsoft Defender: Trojan:Win32/Astaroth!pz
Emsisoft (Emergency Kit): Trojan.Agent.EZWM
Trellix Stinger (McAfee): Trojan-Shifu!FB40AB9E69D7
Kaspersky (KVRT): Trojan-Banker.Win32.Shifu.eph

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.Gamarue-9832405-0 (rule Win.Trojan.Gamarue-9832405-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Astaroth!pz (rule Trojan:Win32/Astaroth!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.EZWM (rule Trojan.Agent.EZWM) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-Shifu!FB40AB9E69D7 (rule Trojan-Shifu!FB40AB9E69D7) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Banker.Win32.Shifu.eph (rule Trojan-Banker.Win32.Shifu.eph) - engine signal, weight 0.55, confidence 0.85
Contacted 2 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Embedded network infrastructure: 2.1.0.3 - static signal, weight 0.35, confidence 0.60
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

10118 behavior events · 1 ATT&CK techniques · 3 dropped files.

Dropped files

C:\ProgramData\286hf042h0.exe - 618cccb02dad0ee07c8449edd83dfd64c2f8581472c6e8f9ec680f8ee458b727
C:\Users\analyst\AppData\Local\Temp\tsk_eef5b835b5a1414e.exe - d3a5a2067aa2bd7964c1e5fa8b719e161f71002b4a375c548c87889d5624ae87
C:\Users\analyst\AppData\Local\Temp\3492473cd35c8bdceed8 - 33d3dd51d80783a81637d4a98197053be5d168ca167226e58d9cb86232d3302e

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

2.1.0.3
20.42.73.27
52.123.252.222
4.230.171.124
85.210.193.152
135.232.92.97
20.184.175.12
20.165.94.63
48.211.4.16
4.144.132.114
52.123.252.226
20.42.179.192
52.110.12.22
52.110.12.19
72.145.35.98
52.148.114.188
52.110.12.37
52.110.12.40

More Shifu samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report