MALICIOUS — 28e7da0cf12d53d4db247c08409f08d81f72c8fdda9ffe4f0e0cba19afab5f82

MALICIOUS — 28e7da0cf12d53d4db247c08409f08d81f72c8fdda9ffe4f0e0cba19afab5f82 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Vobfus family. 7 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 28e7da0cf12d53d4db247c08409f08d81f72c8fdda9ffe4f0e0cba19afab5f82
SHA-1: 817e564d1546019f0d2f4c807d6003a77488873f
MD5: 959e11773e5658103ff49c54b2dcdeb8
imphash: 3f92177474a00f02451a855b96e05f57
ssdeep: 3072:3Hjk+0oLnWFnzBHv/xWFsg8WatFBGFVWPE5ac0pG/1z+QVMbg1:Xo/BHng5HaVG4G/1z+QVMbg1
TLSH: T112428D8B3A29EE42E2E7DA075D04FDBD208F4897263AF5682AD9D51E44C327B043113D
Submitted as: 28e7da0cf12d53d4db247c08409f08d81f72c8fdda9ffe4f0e0cba19afab5f82
File type: pe · Size: 208896 bytes
Verdict: malicious (100/100) · Family: Vobfus

Detections (7 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Worm.Vobfus-7513439-0
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Worm:Win32/Cambot.A
Emsisoft (Emergency Kit): Trojan.GenericKD.50020741
Kaspersky (KVRT): Trojan.Win32.Llac.llzl

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Worm.Vobfus-7513439-0 (rule Win.Worm.Vobfus-7513439-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 26 external host(s) at runtime (31 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
Extracted BlackshadesRAT config (0 C2) - engine signal, weight 0.45, confidence 0.60
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.facebook.com/?ref=home, http://www.facebook.com - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

6504 behavior events · 3 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\ag58fpqon.exe.jpg - ff1a2b8c7fec6cf850a65a8e1d4fdbe17f6e422927220a3ff220d14cb67db10f

Embedded URLs

http://www.facebook.com/?ref=home
http://www.facebook.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787882765&P2=404&P3=2&P4=kvjq4HnGUNNHR6ASAzp7EBSvD%2bPhSHaGKz8m%2bpGrvXAhI3zgQobsevZ6k%2f29zlQ32XHmpSd88RqgBfbCPvX3yw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://migsel.com/system/classes/alive.php?key=Blackshades%5FKey&pcuser=analyst&pcname=DESKTOP%2DHSGCBEP&hwid=800E9CC0&country=United+States
http://migsel.com/system/classes/fg.php?key=Blackshades%5FKey
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787882813&P2=404&P3=2&P4=NrA1NU8nnSx0aNLiqYxuS3p01xjAHFw9pHIINfD8Qx2gPfax%2bdDDySCbHpz%2bHXU4YOjHAIWxfPTj4YObOmK28w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787279471&P2=404&P3=2&P4=e27uT14eS%2bUVK%2fUFFef8eyjkfmVuNGcK444YfuvP2GeUY89V1FpWjkVkourU%2bkQQXRQluj6dVrarE%2bLLm4thYA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787279091&P2=404&P3=2&P4=d7hmdnrIMj4W9QH8UjvQdQ4T4pGCyNoFkTOtaq4%2f43AOJ%2fmJveewBRH8rm1F7%2bFrIj9nFbGmAy6WsBkWuimqRg%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.facebook.com
bankofamerica.com
migsel.com

Embedded IP addresses

20.42.65.93
172.215.188.225
4.230.171.124
52.230.59.222
20.165.94.63
74.178.240.51
52.168.112.66
20.112.250.133
52.123.129.14
40.103.64.226
52.168.117.168
40.84.85.40
203.26.79.13
135.233.45.221
74.179.71.159
95.128.128.129
52.148.114.188
92.223.78.30
4.150.223.96
20.50.201.205
72.154.7.16
4.209.250.170
4.150.223.101
20.184.175.0
52.110.12.4

Registry keys

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows

File paths

C:\Program
C:\Windows\SysWOW64\ieframe.dll

More Vobfus samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report