MALICIOUS — 202e13f9c71a666f1729780f5769cc0d29380cd684a2926480f2a721b067c35d

MALICIOUS — 202e13f9c71a666f1729780f5769cc0d29380cd684a2926480f2a721b067c35d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Infostealer family. 4 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 202e13f9c71a666f1729780f5769cc0d29380cd684a2926480f2a721b067c35d
SHA-1: 0ac7f7b7cef9b1cfb10829212dbe5d2669c47a0d
MD5: eea43bc2c8ecaf8a0ceb8def58973bec
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 192:3BksuDEXVwV2heMZZ3K93VnjdwCzW32Ww6:pVwoheMmFnhwCCGWw
TLSH: T17E2209EF5A584B83CB7AD41B6145CD7EB480749E68B3228D12048B335438833997E7EB
Submitted as: 202e13f9c71a666f1729780f5769cc0d29380cd684a2926480f2a721b067c35d
File type: pe · Size: 9728 bytes
Verdict: malicious (100/100) · Family: Infostealer

Detections (4 of 52 engines)

ClamAV (daily): Win.Malware.Msilkrypt-9839010-0
Microsoft Defender: PWS:MSIL/Infostealer.PAC!MTB
Emsisoft (Emergency Kit): Gen:Trojan.Mardom.PN.13
Kaspersky (KVRT): HEUR:Trojan.MSIL.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Msilkrypt-9839010-0 (rule Win.Malware.Msilkrypt-9839010-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7860) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged PWS:MSIL/Infostealer.PAC!MTB (rule PWS:MSIL/Infostealer.PAC!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Trojan.Mardom.PN.13 (rule Gen:Trojan.Mardom.PN.13) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.MSIL.Agent.gen (rule HEUR:Trojan.MSIL.Agent.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 32 external host(s) at runtime (15 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
Extracted RedLine config (0 C2) - engine signal, weight 0.45, confidence 0.60
Embedded network infrastructure: http://tempuri.org/IUserService/GetUsersT, http://194.87.145.184:6484/UserService, 194.87.145.184 - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

3935 behavior events · 2 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://tempuri.org/IUserService/GetUsersT
http://194.87.145.184:6484/UserService
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786554123&P2=404&P3=2&P4=EhxkS8wgTIDEz1U%2bEYyGBNpyeHNyhewb%2f1eIOCcI%2bRH7wkTkWU6N%2b780w1Nj7lMGeC3iUNXbg%2bvK%2bCIDX7Baiw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.datacontract.org
tempuri.org

Embedded IP addresses

194.87.145.184
4.247.188.233
20.184.175.12
52.230.60.54
4.230.171.124
20.42.179.192
135.233.95.144
74.178.76.54
4.150.223.103
20.42.73.30
172.178.240.162
172.178.240.161
149.154.167.99
149.154.164.25
203.26.79.13
72.145.35.101
74.178.76.44
162.159.142.9
52.110.12.37
52.110.12.28

More Infostealer samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report