MALICIOUS — 2e251f134fec649859a6b2db5edd0a78ac4b51af2e1015c70c3903684e99b6b7
MALICIOUS — 2e251f134fec649859a6b2db5edd0a78ac4b51af2e1015c70c3903684e99b6b7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the EYLR family. 5 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
2e251f134fec649859a6b2db5edd0a78ac4b51af2e1015c70c3903684e99b6b7 - SHA-1:
863de6f154a5a321ad33bc496861eadcf1f273be - MD5:
65bd4bc79f95fde7cbf38256f5327e12 - imphash:
802dcac7aab948c19738ba3df9f356d9 - ssdeep:
1536:ytri2WOitri28Oitri2VOitri28Oitri29Oitri28Oitri2VOitri28O:Ur+rEr/rErHrEr/r - TLSH:
T1FC3DA66705A19D9BF617D6FB5480DF0D28F2E4F899B701D81E82DC0DA67CC5328A920E - Submitted as: 2e251f134fec649859a6b2db5edd0a78ac4b51af2e1015c70c3903684e99b6b7
- File type: pe · Size: 131072 bytes
- Verdict: malicious (84/100) · Family: EYLR
Detections (5 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): PureBasic
- Detect It Easy (packer/type): DIE:PureBasic
- Microsoft Defender: Trojan:Win32/Zexa.WE!MTB
- Emsisoft (Emergency Kit): Trojan.Agent.EYLR
- Kaspersky (KVRT): Trojan.Win32.Agentb.kntn
MITRE ATT&CK
Why this verdict
The malicious score of 84/100 is the fusion of 5 weighted signals:
- Microsoft Defender flagged Trojan:Win32/Zexa.WE!MTB (rule
Trojan:Win32/Zexa.WE!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Agent.EYLR (rule
Trojan.Agent.EYLR) - engine signal, weight 0.55, confidence 0.85 - Detect It Easy (packer/type) flagged DIE:PureBasic (rule
DIE:PureBasic) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: PureBasic - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
32 behavior events · 1 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- desktop-hsgcbep
- www.bing.com
- config.edge.skype.com
- dns.msftncsi.com
- settings-win.data.microsoft.com
- edge.microsoft.com
- aps.prod.windows.com
- watson.events.data.microsoft.com
- 192.168.122.108
- 224.0.0.252
- 192.168.122.1
- 192.168.122.255
- 192.168.122.107
- 192.168.122.70
- 192.168.122.105
- 224.0.0.22
Dropped files
- /opt/CAPEv2/storage/analyses/4522/files/cec0d408e0bc9dd5aab1c21806f1043f16b4bddb8d26211bf20fb9d95740bdfd -
cec0d408e0bc9dd5aab1c21806f1043f16b4bddb8d26211bf20fb9d95740bdfd
File paths
- C:\Users\
More EYLR samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report