MALICIOUS — 2f9a7672e8ca26e68bb366ab730a7a4bd06270f04128ddebf69f3a93ed536534

MALICIOUS — 2f9a7672e8ca26e68bb366ab730a7a4bd06270f04128ddebf69f3a93ed536534 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100), attributed to the Msilperseus family. 8 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 2f9a7672e8ca26e68bb366ab730a7a4bd06270f04128ddebf69f3a93ed536534
• SHA-1: 309de0d16b537968a5146ec2832600fb2a7348a7
• MD5: 4e412fd5c9db3b862519a8a4c89a7c2d
• imphash: f34d5f2d4577ed6d9ceec516c1f5a744
• ssdeep: 3072:JO+bY++73VQdqPg7WqD+NhGJZstCVH9xGSp+BPq19XAHtUcmzC:MWWzcJZs0d91WPquUcmO
• TLSH: T1DD4217BEFEA90E23C8FEEDD71C9A806E65C45846A0BD5250C7F7603225136338A61573
• Submitted as: 2f9a7672e8ca26e68bb366ab730a7a4bd06270f04128ddebf69f3a93ed536534
• File type: pe · Size: 213195 bytes
• Verdict: malicious (95/100) · Family: Msilperseus

Detections (8 of 52 engines)

• capa (capabilities): capability:execution/powershell
• MalwareAnalyser heuristics (entropy/packer): .NET Reactor 4.8-4.9
• ClamAV (daily): Win.Malware.Msilperseus-9884190-0
• YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
• Detect It Easy (packer/type): DIE:.NET Reactor 4.8-4.9
• Kaspersky (KVRT): HEUR:Trojan-Dropper.Win32.Agent.gen
• Microsoft Defender: Trojan:MSIL/Razy!atmn
• Emsisoft (Emergency Kit): Gen:Variant.Jalapeno.446

MITRE ATT&CK

• T1059.001

Why this verdict

The malicious score of 95/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Win.Malware.Msilperseus-9884190-0 (rule Win.Malware.Msilperseus-9884190-0) - engine signal, weight 0.90, confidence 0.95
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:.NET Reactor 4.8-4.9 (rule DIE:.NET Reactor 4.8-4.9) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: .NET Reactor 4.8-4.9 - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

More Msilperseus samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report