MALICIOUS — 307879ecc86565ccb0bf9a72c7d3b0d3906e2fcd9940d64b36afbcf40352d19b

MALICIOUS — 307879ecc86565ccb0bf9a72c7d3b0d3906e2fcd9940d64b36afbcf40352d19b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AntiDebug family. 6 of 56 detection engines flagged it.

Identification

SHA-256: 307879ecc86565ccb0bf9a72c7d3b0d3906e2fcd9940d64b36afbcf40352d19b
SHA-1: edc97bcbcf202edf097d34dc094c26c5b2f8a81a
MD5: 9715e2ef6ade03dbe764a255a45e7050
imphash: ba8fb4919796ba15ef3c17ab1a11e5fc
ssdeep: 49152:sIm2s0vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv:sIm2s
TLSH: T1236C6B0652663488E874BD240E0BB69E3E3AB6ADC3BB7F04505AD5533471343A1D8AF7
Submitted as: 307879ecc86565ccb0bf9a72c7d3b0d3906e2fcd9940d64b36afbcf40352d19b
File type: pe · Size: 11512320 bytes
Verdict: malicious (100/100) · Family: AntiDebug

Detections (6 of 56 engines)

ClamAV (daily): Win.Trojan.Generic-9906195-0
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/Azorult.RW!MTB
Emsisoft (Emergency Kit): Trojan.Crypt
Trellix Stinger (McAfee): Packed-GDT!9715E2EF6ADE
Kaspersky (KVRT): HEUR:Backdoor.Win32.Tofsee.gen

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9906195-0 (rule Win.Trojan.Generic-9906195-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Azorult.RW!MTB (rule Trojan:Win32/Azorult.RW!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Crypt (rule Trojan.Crypt) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Packed-GDT!9715E2EF6ADE (rule Packed-GDT!9715E2EF6ADE) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Backdoor.Win32.Tofsee.gen (rule HEUR:Backdoor.Win32.Tofsee.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 2 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Extracted Tofsee config (0 C2) - engine signal, weight 0.45, confidence 0.60
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 55.9.42.91, 2.8.50.41 - static signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

15 behavior events · 0 ATT&CK techniques · 3 dropped files.

Dropped files

ecac1f774712981d8976fd6d43c1f2f74dc8d6414d79116bc0e0dcae73e94ea9 - ecac1f774712981d8976fd6d43c1f2f74dc8d6414d79116bc0e0dcae73e94ea9
448e8aeb2dcd412f100bd4271b6bc0f87d6922877f96d874d74144ec811de88c - 448e8aeb2dcd412f100bd4271b6bc0f87d6922877f96d874d74144ec811de88c
f582d558766f80ec38f5441eea5aaebc3b3ecfab779a741b25e3ae11bdbfac84 - f582d558766f80ec38f5441eea5aaebc3b3ecfab779a741b25e3ae11bdbfac84

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

55.9.42.91
2.8.50.41
20.184.175.8
52.250.34.200
74.178.76.54
4.230.171.124
20.42.65.88
20.165.94.63
4.247.188.224
52.178.17.2
52.110.12.24
162.159.142.9
172.178.240.162
48.192.143.121
34.104.35.123
52.110.12.51
52.110.12.10

File paths

f:\dd\vctools\crt_bld\self_x86\crt\src\_file.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.c
f:\dd\vctools\crt_bld\self_x86\crt\src\w_env.c
f:\dd\vctools\crt_bld\self_x86\crt\src\tidtable.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbctype.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mlock.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_getbuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\onexit.c
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
C:\tucowe-dokuz-wamobabu\19\fibili.pdb
f:\dd\vctools\crt_bld\self_x86\crt\src\puts.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strtol.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fwrite.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fileno.c
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
f:\dd\vctools\crt_bld\self_x86\crt\src\crt0msg.c
f:\dd\vctools\crt_bld\self_x86\crt\src\intel\fp8.c
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cvt.c
f:\dd\vctools\crt_bld\self_x86\crt\src\isctype.c
f:\dd\vctools\crt_bld\self_x86\crt\src\localref.c

More AntiDebug samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report