MALICIOUS — ransomware-simul.exe

MALICIOUS — ransomware-simul.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the LODEINFO family. 7 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 2bebb7cfbb76f01b40e9a2bd037407c356a6ff7cab99f31fc7df9fda0aa0f1fe
SHA-1: b78c4ebd722aaa3a7c3d759e3ea77f04bfd16e4a
MD5: 86c0f81917dd22af0758ddb37d1cf758
imphash: d42595b695fc008ef2c56aabd8efd68e
ssdeep: 49152:NPRD6Z3bdSu0wJUGpGaTylT3mkSIZRMBpsw+dfW6QhfkUWKK5vFPWNWgEZ2nxDf:NRnIZK5BWGZH8ZSKtURo6vTF
TLSH: T1E1668DE556577426C5F4CD08F472C0DCD88B7C9AA2742D8E0343E92951FAF6FABA004A
Submitted as: ransomware-simul.exe
File type: pe · Size: 6269440 bytes
Verdict: malicious (93/100) · Family: LODEINFO

Detections (7 of 52 engines)

capa (capabilities): capability:execution/powershell
MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:/19,/32,/65,/78,/90
YARA: JPCERT/CC: JPCERT_LODEINFO
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
Kaspersky (KVRT): UDS:Trojan-Ransom.Win32.Hive.jg
Microsoft Defender: Ransom:Win64/GoHive.PAA!MTB
Emsisoft (Emergency Kit): Generic.Ransom.Hive.A.9AF5A4FF

MITRE ATT&CK

Why this verdict

The malicious score of 93/100 is the fusion of 10 weighted signals:

Memory forensics: 6 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 1212) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 24 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_LODEINFO (rule JPCERT_LODEINFO) - engine signal, weight 0.35, confidence 0.70
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://go.dev/issue/66821, http://thisisafakeonionaddress.onion/, https://www.torproject.org/ - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:/19,/32,/65,/78,/90 - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

388 behavior events · 1 ATT&CK techniques · 0 dropped files.

Embedded URLs

https://go.dev/issue/66821
http://thisisafakeonionaddress.onion/
https://www.torproject.org/
https://github.com/spf13/cobra/issues/1279
https://github.com/spf13/cobra/issues/1508
http://cairographics.org
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786411202&P2=404&P3=2&P4=YbPF5H7%2b47c7Gfic2VPezcLb96QM7l2dBdghuftMkQdK7c2nCaimei2rWnJ1ubfgl5xy09aYy9Z%2fUNGEKnfVYQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

abi.name
godebugs.info
github.com
golang.org
go.dev
disclose.to
www.torproject.org
comp.name
runtime.link
reflectlite.name.name
reflectlite.rtype.name
reflectlite.rtype.in
eq.io
unicode.in
unicode.to
go.shape.int
eq.net
hash.net
eq.github.com
cobra.name
exec.in
cairographics.org
z9.ga
fmt.space
runtime.work

Embedded IP addresses

52.110.12.8
20.184.175.11
52.123.252.244
4.144.132.114
4.230.171.124
48.211.4.16
74.179.77.204
74.178.240.51
20.42.65.89
135.234.160.245
203.26.79.13
74.178.232.29
72.153.5.129
52.110.12.16
92.223.78.30
52.110.12.32

More LODEINFO samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report