MALICIOUS — 2957e912ac2bd146a7a8037d6620b7dfafad307133f9bc614d3570150c15a8f4

MALICIOUS — 2957e912ac2bd146a7a8037d6620b7dfafad307133f9bc614d3570150c15a8f4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fileinfector family. 4 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 2957e912ac2bd146a7a8037d6620b7dfafad307133f9bc614d3570150c15a8f4
SHA-1: 053366793b5ddf88d45a3d88f6781c6acdf7d2ec
MD5: 3ffc406bc65ba5e481c6dd5c87e5aee2
imphash: a9192bab5c7c795c7488b69a1853f9c2
ssdeep: 384:GBXUFh1yvN/uMmxDMm4eeJEpTe/OrHiJhqxHUIFdiLdKx9UIFQZ7jONCxZIFzJM:MXUs1ZmxDMmCge2eCUX+UhOa
TLSH: T1EA38D8CD23989D27F890AE64FD1C881C7001D6B523BAB7DC2C44CDEE79A967B1931462
Submitted as: 2957e912ac2bd146a7a8037d6620b7dfafad307133f9bc614d3570150c15a8f4
File type: pe · Size: 81920 bytes
Verdict: malicious (100/100) · Family: Fileinfector

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Fileinfector-9832954-0
Microsoft Defender: Trojan:Win32/CryptInject!pz
Trellix Stinger (McAfee): Trojan-FULM!3FFC406BC65B
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Fileinfector-9832954-0 (rule Win.Malware.Fileinfector-9832954-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/CryptInject!pz (rule Trojan:Win32/CryptInject!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FULM!3FFC406BC65B (rule Trojan-FULM!3FFC406BC65B) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.ks (rule Virus.Win32.Lamer.ks) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.pinkworld.com, http://www.youporn.com, http://www.redtube.com - static signal, weight 0.35, confidence 0.60
Dropped 23 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

93156 behavior events · 2 ATT&CK techniques · 38 dropped files.

Dropped files

C:\Windows\System32\license.rtf - 6ead36905bca28296a730d4432158b078dcb7abad91d450fe64bab0083f33219
C:\Windows\DtcInstall.log - 9450cbb7b4ec5fcb5d41331abf37eab812ede27f4d2a780c6276371499f10668
C:\Windows\System32\mmc.exe.config - f4bbf726b03d41e4fa79079a8ac89255614a3778fd12506ece882e5699f6c246
C:\Windows\Professional.xml - 8dd3c0abec847b5af024d1b0d4d8d5149607bf39f209f2049a1014e308114357
C:\Windows\System32\vccorlib140.dll - 1814ba92030d23124114bc0d1c873abd5e633c42615e2f16d5ca5156813bd178
C:\Windows\System32\vcruntime140_threads.dll - 209c62a0de18bb5972e6025d0d01c2300fea84551836012ed6fca1c436bc0f46
C:\Windows\System32\mfc140u.dll - 07663c6e554d606ca79ef19950fcff370e1a2c320c805eed5323c1a878650075
C:\Windows\System32\msvcp140_codecvt_ids.dll - 07cf0733f7925952133b4b1097ff82d802104159c8b9eeca19c218299bc4b49e
C:\Windows\PFRO.log - c12a3ca645947edc228282461134ef93db2d450af7bf747bb14d5ac4096efe15
C:\Windows\System32\msvcp140_atomic_wait.dll - 1595761b60f3a7071523175fa709df9b9703d5d3ec429d5ada6dcb9edc282f94
C:\Windows\setupact.log - d500e55c99b2c30e93a7f4b756b30ec8810f5b318df59925957e643d4076547a
C:\Windows\System32\mfcm140u.dll - 8017d15091c7572466eb9ae7e5aa4c95c25105f0d03ab7d89d475d88650a9641
C:\Windows\System32\vcruntime140.dll - 7acfe4cd824d6aba1f75e8495e901812f5708fecbf4f45243b9643a8dd0b3f27
C:\Windows\WindowsUpdate.log - 1488bf16b92213f38aaca138fd2703ba611f59b32a77140f86328261be0980a2
C:\Windows\win.ini - 7e0db5ab74be8ea25dfa64f29ef79498e5db9825cd8d917629c60a11042d5f9e

Embedded URLs

http://www.pinkworld.com
http://www.youporn.com
http://www.redtube.com
http://www.assparade.com/
http://www.freeav.com/
http://www.antispyware.com/
http://www.antivirus.com/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.pinkworld.com
www.youporn.com
www.redtube.com
www.assparade.com
www.freeav.com
www.antispyware.com
www.antivirus.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

0.0.0.6
4.150.223.99
52.253.84.76
52.123.252.224
4.230.171.124
104.18.33.89
4.207.44.76
52.168.117.170
162.159.142.9
52.110.12.14
52.110.12.19
172.178.240.162
20.42.179.204
172.215.188.225
52.148.114.188
72.153.5.141
92.223.78.30
52.110.12.22
52.110.12.37

File paths

C:\Windows\system32\d3dx10_36.dll
C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_0b66cb
C:\Windows\servicing\sqm\
C:\Program
C:\Progr

More Fileinfector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report