MALICIOUS — 2845f7c44a9c5f33156c0f9ca7b39d5ff480fab0f900b3d66ab6a121c9725110

MALICIOUS — 2845f7c44a9c5f33156c0f9ca7b39d5ff480fab0f900b3d66ab6a121c9725110 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Vmprotect family. 7 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 2845f7c44a9c5f33156c0f9ca7b39d5ff480fab0f900b3d66ab6a121c9725110
SHA-1: 8df1f29410e95786dedbf93d35e1a20b2fc05f61
MD5: 752dfc420c96dedfeb0f066defdf47db
imphash: 7184fc9596d8d6d6d2b2b761ab9e2133
ssdeep: 12288:SYzGVM3VyJgeE7uXsQeVtBKNkWPamSNRZPQ7sH9vW8W8r867Du6:SPMl6gl7PJV3KCPYE9OyDJ
TLSH: T1ED4B234869012E80F5705D09ECEE0E6E649337BFB7162C4E2205489F2799DAF6F314A7
Submitted as: 2845f7c44a9c5f33156c0f9ca7b39d5ff480fab0f900b3d66ab6a121c9725110
File type: pe · Size: 491304 bytes
Verdict: malicious (100/100) · Family: Vmprotect

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
ClamAV (daily): Win.Packed.Vmprotect-10023076-0
YARA: Yara-Rules community: YR_Packer_VMProtect
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Barys.GXV!MTB
Emsisoft (Emergency Kit): Gen:Variant.Barys.160809
Kaspersky (KVRT): HEUR:Trojan.Win32.Convagent.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Packed.Vmprotect-10023076-0 (rule Win.Packed.Vmprotect-10023076-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Barys.GXV!MTB (rule Trojan:Win32/Barys.GXV!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Barys.160809 (rule Gen:Variant.Barys.160809) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Convagent.gen (rule HEUR:Trojan.Win32.Convagent.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_Packer_VMProtect (rule YR_Packer_VMProtect) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Themida/VMProtect (rule Themida/VMProtect) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Themida/VMProtect, high-entropy-sections:.vmp1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

96 behavior events · 0 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Program Files (x86)\devae\ijtd.exe - 34729958c8a5629f4a8a92da0e794468252a1509b73f615d3b65f93f33eb2253
5726735f5917dee8b5c089dff0a3a89551208538a5b12d762f56941642585220 - 5726735f5917dee8b5c089dff0a3a89551208538a5b12d762f56941642585220

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

4.207.44.70
52.123.252.192
4.230.171.124
85.210.193.152
135.232.92.97
52.230.59.222
135.233.95.144
20.50.201.200
104.18.33.89
135.232.92.137
52.110.12.38
52.110.12.40

More Vmprotect samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report