MALICIOUS — 28c0a15e09324439ba5127ef189c1936eafcd75232b7da8df925c78645e9f890

MALICIOUS — 28c0a15e09324439ba5127ef189c1936eafcd75232b7da8df925c78645e9f890 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Vflooder family. 8 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 28c0a15e09324439ba5127ef189c1936eafcd75232b7da8df925c78645e9f890
SHA-1: 99d8e2b4724381b45a6661ef666d08947445b45b
MD5: 5f353814bf0945cc2d917a20809b54ba
imphash: 2530491d48892f2e1a2d640515c13122
ssdeep: 1536:6H2flKKEt/YeGDhHQWx4LERohhXRsN8ibrXbgMk9TVbDsMDiET9PDCo/M:+gKKEC5x49BsSibXgMQTVbDfiPgM
TLSH: T1CF38F10172056C98D378D42DED6E6D3C21B6ECAF307A30C8C257185E83519B756AA0F9
Submitted as: 28c0a15e09324439ba5127ef189c1936eafcd75232b7da8df925c78645e9f890
File type: pe · Size: 82048 bytes
Verdict: malicious (99/100) · Family: Vflooder

Detections (8 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
ClamAV (daily): Win.Trojan.Agent-1352525
YARA: Yara-Rules community: YR_Packer_VMProtect
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Vflooder!pz
Emsisoft (Emergency Kit): Dump:Trojan.Agent.BYFH
Trellix Stinger (McAfee): Agent-FEU!E59F6A9DB0A5
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-1352525 (rule Win.Trojan.Agent-1352525) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 32 external host(s) at runtime (32 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_Packer_VMProtect (rule YR_Packer_VMProtect) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: Themida/VMProtect, high-entropy-sections:.vmp1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

25155 behavior events · 2 ATT&CK techniques · 9 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199 - a6f8f5d4ffd1e825ffce9a55861f16aa4dbe67871b1696b976194dd8be1fdf29
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199 - 817673b8903a1da096084bff055598b0f712bf688a175e66e5a49954c6bba403
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA - c866c5536689efca1ae8a0b4b170cae4bc8049282530fb3f8197a6933d88eebb
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75A092F4522006A97542D6AC4F4E69D2 - 27fd9a321bb916cdd4b35e479fe82de7ada49104d52836f06161e02f2f135dd2
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75A092F4522006A97542D6AC4F4E69D2 - 33badd3794c0d5d02e18e88f818cf71444cba34ce75037bc4112d7f080f42f7d
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA - 21dd2513fa7c4380d41c0e87c8099bd27d5d64aaa2d8d9113972e302e6ceaadc
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\71D3A36027B1506445FB345FD67207AC - c2b5248ca009b682a6b97afe46f88089bca9d38a750f393c6d5b280664307cae
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\71D3A36027B1506445FB345FD67207AC - a95fc9304e6b6a815cdade01c53e4a0f40c847e126d0d97d4e20b9808d4a4a3d
133033cbc1015d0f65038d4274b8dd3184a1741be453e15ad31ddd30ac8c9b51 - 133033cbc1015d0f65038d4274b8dd3184a1741be453e15ad31ddd30ac8c9b51

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787796059&P2=404&P3=2&P4=FQi8isEHtxvGcEHe9PxzEB88WOup6so8CegRE0QY37H81RCsxsngRmRCRoolz%2bpaeWNKFeh7crcXNALtZOUvIQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://google.com/
http://c.pki.goog/r/r1.crl
http://c.pki.goog/wr2/oBFYYahzgVI.crl
http://www.virustotal.com/vtapi/v2/file/scan
http://c.pki.goog/wr3/MbJBMFoQ-sk.crl
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787796131&P2=404&P3=2&P4=mtH6anB6ujZo28JfkrZKi8tow083JYUtXYk6iennQaJ6hpZFrRJZu%2ft1jSp0v7FBZtndiOo30fDa5vprHGUg4w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.virustotal.com
a6281279.yolox.net

Embedded IP addresses

52.168.117.170
52.123.252.218
4.144.132.223
4.230.171.124
40.84.85.40
74.178.240.61
4.150.223.104
135.233.95.135
52.123.252.244
52.182.143.212
20.112.250.133
52.123.129.14
52.123.128.14
203.26.79.13
172.178.240.161
52.123.252.193
74.179.71.159
34.54.88.138
162.159.142.9
52.110.12.4
52.110.12.24
52.148.114.188
72.154.7.107
142.251.42.99
142.250.195.163

More Vflooder samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report