MALICIOUS — 23fb34a6c0a6bc056c42c81f4e0942171d25711338b5bd50c2b4cd339decb104

MALICIOUS — 23fb34a6c0a6bc056c42c81f4e0942171d25711338b5bd50c2b4cd339decb104 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Wapomi family. 7 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 23fb34a6c0a6bc056c42c81f4e0942171d25711338b5bd50c2b4cd339decb104
SHA-1: 52c8a5295bc4ca354b39fde6e62dc8ee047ea48b
MD5: ed7bbf3d42b3595d4e71c9baf5cd44a5
imphash: e38062877caac65585afa2d2c3200df4
ssdeep: 768:WV29n/P4/CSoY+gJXfxQGPL4vzZq2o9W7GsxBbPr:FPZhYrf2GCq2iW7z
TLSH: T1DB2DBFCE0B543E89D9CAD912F4848E1C2B07EAAC2639758C6903E52F517096B6C29F4C
Submitted as: 23fb34a6c0a6bc056c42c81f4e0942171d25711338b5bd50c2b4cd339decb104
File type: pe · Size: 28672 bytes
Verdict: malicious (100/100) · Family: Wapomi

Detections (7 of 52 engines)

ClamAV (daily): Win.Malware.Wapomi-10020301-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Kaspersky (KVRT): Virus.Win32.Nimnul.f
Microsoft Defender: Virus:Win32/Mikcer.B
Emsisoft (Emergency Kit): Win32.VJadtre.3
Trellix Stinger (McAfee): Trojan-FVWC!ED7BBF3D42B3

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Wapomi-10020301-0 (rule Win.Malware.Wapomi-10020301-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Madeba): 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07 - dynamic signal, weight 0.80, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 36 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

13662 behavior events · 2 ATT&CK techniques · 50 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/10663/files/830a088414ee822747dfe6164db39280311a7804489560a172972a5590234990 - 830a088414ee822747dfe6164db39280311a7804489560a172972a5590234990
/opt/CAPEv2/storage/analyses/10663/files/4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07 - 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
/opt/CAPEv2/storage/analyses/10663/files/0e03675850241d06080af9ec470649ca4a006222c4ff5d1b05029f1751fecf91 - 0e03675850241d06080af9ec470649ca4a006222c4ff5d1b05029f1751fecf91
/opt/CAPEv2/storage/analyses/10663/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/10663/files/74f83fe7121643d5b71f4b87981bb3a4b613234b3809d13b3d9d68d239954c2c - 74f83fe7121643d5b71f4b87981bb3a4b613234b3809d13b3d9d68d239954c2c
/opt/CAPEv2/storage/analyses/10663/files/8a4b03cea10e807a32636b3cf7820a53981a0a175c7fc4e2b231e16a9f87f1ac - 8a4b03cea10e807a32636b3cf7820a53981a0a175c7fc4e2b231e16a9f87f1ac
/opt/CAPEv2/storage/analyses/10663/files/920fb0937f8a9d345830865059b6ae3f35ab6803ad4cffef4447473ec18e17a0 - 920fb0937f8a9d345830865059b6ae3f35ab6803ad4cffef4447473ec18e17a0
/opt/CAPEv2/storage/analyses/10663/files/f19afa9bbf2ef0308f37ce6cb87cb3c59eb2d1685e08d8b15fd197dda813f379 - f19afa9bbf2ef0308f37ce6cb87cb3c59eb2d1685e08d8b15fd197dda813f379
/opt/CAPEv2/storage/analyses/10663/files/96c83a3d17fb924d9b8f13bb822c91d479b72fd2dd8d656de2bf0b8acef499a4 - 96c83a3d17fb924d9b8f13bb822c91d479b72fd2dd8d656de2bf0b8acef499a4
/opt/CAPEv2/storage/analyses/10663/files/079771f6478bb63f24119685df1262ea2735295a3022ba6c1d509650800797e4 - 079771f6478bb63f24119685df1262ea2735295a3022ba6c1d509650800797e4
/opt/CAPEv2/storage/analyses/10663/files/bbb3de5707629e6a60a0c238cd477b28f07f0066982fda953fa6fcec39073a4a - bbb3de5707629e6a60a0c238cd477b28f07f0066982fda953fa6fcec39073a4a
/opt/CAPEv2/storage/analyses/10663/files/81bac677e834253ae60125ed1be64b1ed0cf25adacaee3fd70a4000b8d5bd508 - 81bac677e834253ae60125ed1be64b1ed0cf25adacaee3fd70a4000b8d5bd508
/opt/CAPEv2/storage/analyses/10663/files/249b0d96ae8bc49c773c0054b8a6d05f689cbcd9abc9572d30bfb2a2bac36b1a - 249b0d96ae8bc49c773c0054b8a6d05f689cbcd9abc9572d30bfb2a2bac36b1a
/opt/CAPEv2/storage/analyses/10663/files/e91dc258304b42180887679f892e47587a8d67d1140ffb3e8acf79deb95cdb9c - e91dc258304b42180887679f892e47587a8d67d1140ffb3e8acf79deb95cdb9c
/opt/CAPEv2/storage/analyses/10663/files/7e42b39d55f1ad07551daedacb1d0191c4b9cefeadf0008766819626bac923c1 - 7e42b39d55f1ad07551daedacb1d0191c4b9cefeadf0008766819626bac923c1

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786458978&P2=404&P3=2&P4=JBICoqIYNGXeaKfUdLQ4o%2fUpCMQeB7%2fH1Cr0CXVFFUWT7mj8MDhCy8WMNwXNhjedZcMZcODF%2bFsX62yXatTmZg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786459053&P2=404&P3=2&P4=H9kj5FT69SWuXjL3W8JnPiJFE1Jh2VCUjMfl1Oufws38fkt4r8RlGle8GR9Lsv7E6GG%2fM25uhDPj7I%2fSQkOePg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ddos.dnsnb8.net

Embedded IP addresses

13.89.179.15
52.123.252.241
40.84.85.40
4.230.171.124
20.247.184.197
135.233.95.144
4.150.223.107
74.178.76.54
52.110.12.3
52.110.12.37
52.168.112.66
135.234.160.245
3.229.117.57
203.26.79.13
52.123.252.231
135.232.92.34
52.123.252.235
172.215.188.232
72.145.35.112
52.148.114.188
52.110.12.20

More Wapomi samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report