MALICIOUS — 2d0f066184dd6b4744e0c90086bc2becc43cc6d866b6ccba6f2eca5db6efe2cd

MALICIOUS — 2d0f066184dd6b4744e0c90086bc2becc43cc6d866b6ccba6f2eca5db6efe2cd is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fileinfector family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 2d0f066184dd6b4744e0c90086bc2becc43cc6d866b6ccba6f2eca5db6efe2cd
SHA-1: c456dc028bca4d2c6f1f907ca2983fc896f02f97
MD5: f290acfcf563b9da713991d64abb1917
imphash: 895fbb56c02c3d2bca3125cef5da8730
ssdeep: 768:ae2mxDMm+STZ5UW0Z080t0M0+RNm6gNSXaCVaqE/Sh6SuEidJlOeIMrlprcQ:txft5ZNkf8KzrcQ
TLSH: T1E4489485318438EFDCB6A969AC00A93CA511A4D710753BD60EC0D36B3870EF3E99942F
Submitted as: 2d0f066184dd6b4744e0c90086bc2becc43cc6d866b6ccba6f2eca5db6efe2cd
File type: pe · Size: 368640 bytes
Verdict: malicious (100/100) · Family: Fileinfector

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Fileinfector-9834127-0
Detect It Easy (packer/type): DIE:MinGW
Microsoft Defender: Trojan:Win32/Vindor!pz
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Fileinfector-9834127-0 (rule Win.Malware.Fileinfector-9834127-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Vindor!pz (rule Trojan:Win32/Vindor!pz) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.ks (rule Virus.Win32.Lamer.ks) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MinGW (rule DIE:MinGW) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, MinGW - static signal, weight 0.25, confidence 0.55
Dropped 23 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

44062 behavior events · 2 ATT&CK techniques · 38 dropped files.

Dropped files

C:\Windows\System32\vcruntime140.dll - 218f383edef6198a6e561b0d204ea8fdc8b061e1cf8026adb6538b645809ee6b
C:\Windows\System32\concrt140.dll - 9fae21a85ae26a5ae0a360ae38ae5bb135b512a225c34248b89b20bc04a719bf
C:\Windows\pyshellext.amd64.dll - 6a93c7d148d17dc3d9ff249f865da7b53a1e443dc8b0557d15e5819307643b05
C:\Windows\System32\mfc140.dll - 5f0fbea0fd3ef4d54cee80caae6bee57241bb8ee0d430e8ef347ff5c4f3114e5
C:\Windows\System32\vulkan-1.dll - 58c640e8fb32ebdb5cc3c594f5e7411bcf65cb8c85ba16ccd920ab1caf7be0aa
C:\Windows\System32\msclmd.dll - 36a10387bb765a997daf08eea8bbc1b839d48bd0365a7482fc8ae11eb8dfec2d
C:\Windows\System32\mfc140u.dll - 5557dd15bdbd36ff1b3ad6563be4a7a463f894cf5f3734749e11db576ae2108c
C:\Windows\py.exe - 8b16d1344d28f7ebdc73baf955aa0369f8a3a427badcf065cab55838d357a57b
C:\Windows\WindowsUpdate.log - adb05c91b1a774387de6f51ddbe51274d4aaaa87c314d0af9daef345409280fd
C:\Windows\System32\msvcp140_2.dll - 1b88f40d25034d7a48176b59ad348e146db84f9c5db081b9d70cda356df01cc3
C:\Windows\System32\msvcp140_codecvt_ids.dll - aa6b121b4872e66b568fd4965d621a49b0cfcaef08f341924ff47d06883cb4bf
C:\Windows\System32\msvcp140.dll - fff96bac1427777070060e111024b088ebee67be10390a2a0800a29dcd621a59
C:\Windows\System32\NOISE.DAT - 63bdfca6d0e7c8c0670410f44c8b5aed8ef1554eea79eed2934593e4c5f0a021
C:\Windows\System32\msvcp140_atomic_wait.dll - 7ca0ad290d3b75d91830a7ee8a073c5d3e0dc838447539ccc43212b6b025b639
C:\Windows\System32\mfcm140u.dll - 483049a88079f3d87940f92690f620e6809b0eb178b2d3f0683fe1a535df6654

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.21
4.230.171.124
57.155.104.224
52.253.84.76
135.232.92.97
74.178.240.61
51.105.71.137
4.150.223.113
13.89.179.12
135.233.45.222
52.148.114.188
92.223.78.30
72.154.7.110
52.110.12.32
52.110.12.10

File paths

C:\\bin
C:\Program

More Fileinfector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report