MALICIOUS — 28716c30490afc34394cadcca6aafa2106ab69c8faa0c7d8009834a6877d1d8f

MALICIOUS — 28716c30490afc34394cadcca6aafa2106ab69c8faa0c7d8009834a6877d1d8f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lmir family. 7 of 56 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: 28716c30490afc34394cadcca6aafa2106ab69c8faa0c7d8009834a6877d1d8f
SHA-1: 282bb1171e197b3f354b1571bf9f8f3f800e2e02
MD5: 24b927ed43a0820eae3d9def7a7b11de
imphash: aae410db5a351d384de2e35faf59497e
ssdeep: 6144:MajdMJyFRe6azHqTG5WbWLF+WR4VyKh64d:x2JylsKThW4VyP4d
TLSH: T129485CBF0B5F2B17D27BCA2C09046B6E4461F4A6107CB14C1A67D53E93DB817AE2124E
Submitted as: 28716c30490afc34394cadcca6aafa2106ab69c8faa0c7d8009834a6877d1d8f
File type: pe · Size: 371280 bytes
Verdict: malicious (100/100) · Family: Lmir

Detections (7 of 56 engines)

capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:ÒuÛëÔ
ClamAV (daily): Win.Trojan.Lmir-22
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Viking.MD
Emsisoft (Emergency Kit): Generic.Delf.Lmir.A28B2EEC
Kaspersky (KVRT): Trojan-GameThief.Win32.Lmir.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 18 weighted signals:

ClamAV (daily) flagged Win.Trojan.Lmir-22 (rule Win.Trojan.Lmir-22) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.MD (rule Virus:Win32/Viking.MD) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Generic.Delf.Lmir.A28B2EEC (rule Generic.Delf.Lmir.A28B2EEC) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-GameThief.Win32.Lmir.gen (rule Trojan-GameThief.Win32.Lmir.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:ÒuÛëÔ (rule high-entropy-sections:ÒuÛëÔ) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-sections:ÒuÛëÔ - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 84 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

62025 behavior events · 2 ATT&CK techniques · 85 dropped files.

Dropped files

C:\Program Files\Google\Chrome\Application\151.0.7922.174\chrome_pwa_launcher.exe - 12c47365e5b5beec43ca394999ae4ea12f2c62db9b0dcf8b1b23934d463f9b5f
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe - b6d4ad2da001884d14fa43261e343235b7ca7d33def92b36f26b10b0b2f41a35
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68
C:\Program Files\LibreOffice\program\smath.exe - 4299fcf0b40fd95318dd9e1b226a92d254351c61844b08e875365ac042495210
C:\Program Files\LibreOffice\program\opencltest.exe - 0db190366027d85af261ba1badbfa932e7a1fcfd450135357d250acc549c294d
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - 377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\LibreOffice\program\xpdfimport.exe - aeef7e7095b6d3a022a0683b1b134549662602436d4c2791a83673154370f078
C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\MenuCoreApp\AcroShareTarget.exe - ff35db1d989a016c58b54009e89d45a8b63072051114af024a09c7d206f6a318
C:\Program Files\Google\Chrome\Application\151.0.7922.174\notification_helper.exe - f59b20678d7f43a1275a96e974abf59931de72881bd8f69419137ca75f8c11dd
C:\Program Files\LibreOffice\program\gengal.exe - 77ae3786b394a619d1204e89e3bffa303c6160852aa5a630a6a71c9642acb1fe
C:\Program Files\Google\Chrome\Application\chrome.exe - 894401c2a6d2bc7630653e675d592a8fe67c257fdcb328824809379370661e84
C:\Program Files\LibreOffice\program\python-core-3.12.13\bin\python.exe - ca6fec76a86f3078675a8c20f1791e1adab475f3193ad74d3619766bf3a15058
C:\Program Files\LibreOffice\program\sbase.exe - e23b150746895cc0d7252132c1d7d939fccfb97d34aae756f404ed2ff6240bc0
C:\Program Files\7-Zip\7z.exe - 310e3227978ce318af9299ef07a51e548e76ffdb2a4b0c305fca2a356ce7b0c3

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.65.89
20.42.179.192
4.230.171.124
52.230.59.222
104.18.33.89
74.178.240.61
20.42.73.31
135.232.92.97
52.110.12.56
51.116.246.104
52.110.12.42
4.150.223.107
52.182.143.212
72.145.35.96
52.148.114.188
52.110.12.32
52.110.12.47

More Lmir samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report