MALICIOUS — 239f885a76329dcc21fd4ed8f989a336b8e90b495cb1fceee912a6ac9dae5eef
MALICIOUS — 239f885a76329dcc21fd4ed8f989a336b8e90b495cb1fceee912a6ac9dae5eef is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Autoit family. 8 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
239f885a76329dcc21fd4ed8f989a336b8e90b495cb1fceee912a6ac9dae5eef - SHA-1:
0b689002d0d0c6eb147374ecce0b2f901bbeef34 - MD5:
47174a23912fc2ea232168460278907d - imphash:
6ff9090e682b22c5107bfaa71e5ff375 - ssdeep:
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qL3ks3ih1XGWq:v6Wq4aaE6KwyF5L0Y2D1PqLF3c2D - TLSH:
T18B4723D5D5B411B2C7EE9B194E31A86D5CC8BEAB000CA6632151313E8B65AE35CF0DB3 - Submitted as: 239f885a76329dcc21fd4ed8f989a336b8e90b495cb1fceee912a6ac9dae5eef
- File type: pe · Size: 338872 bytes
- Verdict: malicious (98/100) · Family: Autoit
Detections (8 of 55 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Autoit-6991628-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Detect It Easy (packer/type): DIE:UPX
- Microsoft Defender: Worm:Win32/Moarider.A
- Emsisoft (Emergency Kit): Gen:Trojan.Heur.umNfrvxHMZfib
- Trellix Stinger (McAfee): W32/Worm-FMA!47174A23912F
- Kaspersky (KVRT): Trojan.Win32.Autoit.aza
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 9 weighted signals:
- ClamAV (daily) flagged Win.Malware.Autoit-6991628-0 (rule
Win.Malware.Autoit-6991628-0) - engine signal, weight 0.90, confidence 0.95 - 1 behavioral detection(s): Scheduled Task / Job [medium] (rule
tl-scheduled-task) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 25 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:UPX (rule
DIE:UPX) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
- Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
4135 behavior events · 1 ATT&CK techniques · 4 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
Dropped files
- C:\Windows\SysWOW64\commander.exe -
514b2102ae7fd0940b4338e29935ea9fd19b1d8203c94bca8a7bf16f40ef29bc - C:\Windows\Tasks\SA.DAT -
12dc5ccd7fecafe070976a1916e9672e3d53085633c86957aee305ccc584184c - C:\Windows\svhost.exe -
c9c9ce7f29d6b8b222f99f957bb62ea9cf3530baef322caae12b16de883d36d1 - 399769e2b1b7924e1960e00c6c6a681ce48cbe5652cfc16992760407e760a74a -
399769e2b1b7924e1960e00c6c6a681ce48cbe5652cfc16992760407e760a74a
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787770098&P2=404&P3=2&P4=S5LZh8nUpvBkjuEY3FQtMQo6Qom%2ffG5aFzYKUvED930ifeiklYdQT22MELSNWRypKtU588wpjubejfoZvLnqaw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787770119&P2=404&P3=2&P4=Pcb1W9yxvz8p8KiXzLrsehT2U8jKgdIWMCbk7H4RRHUpuzLr1QuNlqHnnODboexlSPVTxtDYozAMCFceXTE%2b8A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 74.179.71.159
- 52.110.12.40
- 52.110.12.8
- 20.184.175.14
- 20.42.179.204
- 4.230.171.124
- 20.247.184.197
- 74.178.240.61
- 20.42.65.94
- 74.178.76.54
- 20.236.44.162
- 52.123.129.14
- 20.184.175.0
- 52.123.252.229
- 203.26.79.13
- 52.123.252.240
- 74.178.76.44
- 52.123.252.234
- 135.234.160.244
- 4.207.44.70
- 52.148.114.188
- 85.210.193.152
- 72.154.7.17
- 52.110.12.51
- 52.110.12.3
More Autoit samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report