MALICIOUS — 27223058b7797e99c2bd01d6ca3d63dc97762539a62fc22ead43bba2a404e241

MALICIOUS — 27223058b7797e99c2bd01d6ca3d63dc97762539a62fc22ead43bba2a404e241 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Redirect family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 27223058b7797e99c2bd01d6ca3d63dc97762539a62fc22ead43bba2a404e241
SHA-1: aee62b915d12fff8868424d141dc3032ea3c5dbb
MD5: b6b5c0d850a0c8caa3802b0360011034
imphash: 11b47caef64b54d3c3efa7c94546ad2b
ssdeep: 3072:mQchyinW3kIncLnntG/j/BJ5mTxjnw89JnszQcJdXi:mkin4kwcDtG/j/75YxF52dXi
TLSH: T1E9417ABF750F6EE6E595CC22426CFB2D337DC95836C10714A83A98BF363A9A30854611
Submitted as: 27223058b7797e99c2bd01d6ca3d63dc97762539a62fc22ead43bba2a404e241
File type: pe · Size: 185928 bytes
Verdict: malicious (100/100) · Family: Redirect

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Redirect-6055402-0
Microsoft Defender: Trojan:Win32/ShipUp!pz
Emsisoft (Emergency Kit): Trojan.Ransom.Cerber.1
Trellix Stinger (McAfee): Packed-AM!B6B5C0D850A0
Kaspersky (KVRT): Trojan.Win32.ShipUp.boq

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Trojan.Redirect-6055402-0 (rule Win.Trojan.Redirect-6055402-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Downware): knmnpxg.dll - dynamic signal, weight 0.62, confidence 0.90
Microsoft Defender flagged Trojan:Win32/ShipUp!pz (rule Trojan:Win32/ShipUp!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Ransom.Cerber.1 (rule Trojan.Ransom.Cerber.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Packed-AM!B6B5C0D850A0 (rule Packed-AM!B6B5C0D850A0) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.ShipUp.boq (rule Trojan.Win32.ShipUp.boq) - engine signal, weight 0.55, confidence 0.85
Contacted 2 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

2549 behavior events · 1 ATT&CK techniques · 6 dropped files.

Dropped files

C:\ProgramData\Mozilla\eaxjrjb.exe - 93dce94651f01bd891b409e00c13a3ef58b8b7f9becb4522e365ec1772a57ce8
C:\ProgramData\Mozilla\knmnpxg.dll - d3d14c684db75ac98d9a034ae2800bfafa156f6d74e5933b3968813bb4f080e4
1ea2bda422c9978286c4b2e75462b71e2907cf08eda7d339d669a0b8adaa2ee6 - 1ea2bda422c9978286c4b2e75462b71e2907cf08eda7d339d669a0b8adaa2ee6
810e21811e2749596905149f4b9c91d5195d7a40703182683f489ee540163bee - 810e21811e2749596905149f4b9c91d5195d7a40703182683f489ee540163bee
c618bd32c7e983cc33653c2b43795cf8ac60664ca92b4f5443ac3c5b83a7f300 - c618bd32c7e983cc33653c2b43795cf8ac60664ca92b4f5443ac3c5b83a7f300
7b1b44babd081ac5ea88f98f49e80923178eff5f485be00fd4a58e91b21231e6 - 7b1b44babd081ac5ea88f98f49e80923178eff5f485be00fd4a58e91b21231e6

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

aefd.nelreports.net

Embedded IP addresses

20.184.175.21
4.144.132.114
52.123.252.247
4.230.171.124
172.64.154.167
74.178.240.51
4.150.223.112
40.84.97.4
20.165.94.63
48.211.4.16
52.110.12.20
20.42.73.30
51.105.71.136
52.110.12.25
72.154.7.113
52.110.12.42
52.148.114.188
52.110.12.50

More Redirect samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report