MALICIOUS — photov_323085435055.lnk

MALICIOUS — photov_323085435055.lnk is a lnk sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (85/100). 3 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 25dfae93b1108728f214c19030acd2d0a45d9c66bfb9a740ebc724a8b22ae2d8
• SHA-1: d30283e8b53df65e3de7af876c79ca93e40895ff
• MD5: 59279fa69ab73e32a3a07199aa2fcdb4
• ssdeep: 24:8sf1lu/3pRuz7HD8g+mwlzWMXXn6hMNqCU64I0wVmOV4I0rVlfX:8seoHoFm8nzNqCUlImOqIyffX
• TLSH: T105169DCD127D1B2AC329C42982B1E3AE0942F1A516FD79524E19997B0213857DEE31B2
• Submitted as: photov_323085435055.lnk
• File type: lnk · Size: 2733 bytes
• Verdict: malicious (85/100)

Detections (3 of 51 engines)

• Microsoft Defender: Trojan:Win32/Ravartar!rfn
• Emsisoft (Emergency Kit): Trojan.GenericKD.80977463
• Kaspersky (KVRT): HEUR:Trojan.WinLNK.Agent.gen

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 85/100 is the fusion of 4 weighted signals:

• Microsoft Defender flagged Trojan:Win32/Ravartar!rfn (rule Trojan:Win32/Ravartar!rfn) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.GenericKD.80977463 (rule Trojan.GenericKD.80977463) - engine signal, weight 0.55, confidence 0.85
• Shortcut launches: powershell - static signal, weight 0.50, confidence 0.80
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

1293 behavior events · 1 ATT&CK techniques · 4 dropped files.

Runtime network

• none

Dropped files

• /opt/CAPEv2/storage/analyses/5574/files/6266e7c1afdb5ff197bc11f42cfc7e3b15a8b285ff61d344498de9cf448d01f5 - 6266e7c1afdb5ff197bc11f42cfc7e3b15a8b285ff61d344498de9cf448d01f5
• /opt/CAPEv2/storage/analyses/5574/files/03df0cf50a12b7d7db44b1b893a4d1e3716a1ce0b4f016c9540017b5ae8b7625 - 03df0cf50a12b7d7db44b1b893a4d1e3716a1ce0b4f016c9540017b5ae8b7625
• /opt/CAPEv2/storage/analyses/5574/files/fb51d49d867c247cbd89914c276b86be8bbf93288797480838fec8288d58af2d - fb51d49d867c247cbd89914c276b86be8bbf93288797480838fec8288d58af2d
• /opt/CAPEv2/storage/analyses/5574/files/504467a6e623504341741275356df7dae5e5de11d5d34103c88324b5a371a09b - 504467a6e623504341741275356df7dae5e5de11d5d34103c88324b5a371a09b

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report