MALICIOUS — 22610d9368182e41229ac0dbf3daa3299c927ce1f5788300cfdfb5329bf0ed11

MALICIOUS — 22610d9368182e41229ac0dbf3daa3299c927ce1f5788300cfdfb5329bf0ed11 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Hoax family. 7 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 22610d9368182e41229ac0dbf3daa3299c927ce1f5788300cfdfb5329bf0ed11
SHA-1: 6277baea57f1bbdddfff9a8a7c526f6978ab2a1b
MD5: bea6d9342a513d020dc96520c4317e5a
imphash: 0818438d729451edf8c455424695687b
ssdeep: 768:vCru/f9Iw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpRiTWNReOO7:71Tzy48untU8fOMEI3jyYfPiuO7
TLSH: T139350A9DCE80CD4AE5A4A9A3B025EC5D4025A4E3FEF7325930D1F46A1CE0CC734597AA
Submitted as: 22610d9368182e41229ac0dbf3daa3299c927ce1f5788300cfdfb5329bf0ed11
File type: pe · Size: 63293 bytes
Verdict: malicious (96/100) · Family: Hoax

Detections (7 of 55 engines)

capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): PureBasic
ClamAV (daily): Win.Malware.Hoax-10019944-0
Detect It Easy (packer/type): DIE:PureBasic
Microsoft Defender: Trojan:Win32/Lazy.AB!MTB
Emsisoft (Emergency Kit): Trojan.Generic.32454626
Kaspersky (KVRT): Hoax.Win32.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Malware.Hoax-10019944-0 (rule Win.Malware.Hoax-10019944-0) - engine signal, weight 0.90, confidence 0.95
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 24 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:PureBasic (rule DIE:PureBasic) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: PureBasic - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1576 behavior events · 0 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\popup.sed - 08de563feb17983f7eee819685d05f4e8f3ecf2696f31bbb1666855cb92a3256
C:\Users\analyst\AppData\Local\Temp\DB4C.tmp\1.bat - 8b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
C:\Users\analyst\AppData\Local\Temp\~%TargetName%.DDF - 29ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787807786&P2=404&P3=2&P4=gy2NZFzOgnSJrHe%2bnkc%2fPwrUtdMk28v%2fARAD01oT15Q73uwuBh5UvCCummQsR%2bJ6UAqqrR%2biAYAjzISXZTl5gQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

www.signs101.com

Embedded IP addresses

52.123.252.245
20.184.175.14
20.42.179.192
4.230.171.124
52.230.59.222
74.178.240.61
52.168.112.67
74.178.240.51
20.165.94.63
20.76.201.171
52.123.129.14
135.233.45.221
52.123.252.246
203.26.79.13
52.148.114.188
52.123.252.224
74.178.76.44
125.56.205.17
125.56.205.120
135.233.95.80
52.123.252.248
72.153.5.96
52.110.12.37
52.110.12.47

File paths

C:\Windows\System32\
C:\\popupe.exe
C:\Raiden\Goat\FTP\Sample\popupe.exe
C:\WINDOWS\system32\popupe.exe
C:\Documents
C:\Users\luser\Desktop\popupe.exe
C:\Users\Frank\Desktop\popupe.exe
c:\\popupe.exe
C:\Users\Lisa\Desktop\popupe.exe
C:\Users\george\Desktop\popupe.exe
C:\Users\maxine\AppData\Local\Temp\popupe.exe

More Hoax samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report