MALICIOUS — 30cf8b82a53fff20b564597e56123ddeb16a87441a8b94f621e52c3213aeaa2c.exe

MALICIOUS — 30cf8b82a53fff20b564597e56123ddeb16a87441a8b94f621e52c3213aeaa2c.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Phorpiex family. 5 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 30cf8b82a53fff20b564597e56123ddeb16a87441a8b94f621e52c3213aeaa2c
SHA-1: 513401f23f65a63d0e7754118b56edb06c9ad676
MD5: 2c735bfeb6d34be3b8cd6008476541d0
imphash: 42cf01d41ef6dc0627982490afc9cddd
ssdeep: 96:CYdFo2Yz/J4h/wQBDB2dyaVDL1x+ZQ75ZTMwmmpPFJxGE9mZ2FFhxC7tCEmJe:CmoFeJBDBgx+e75tpPFJxTEZmFhSm
TLSH: T1D723F81AD710A54FDFF29C8B0089490CB266A37D593E1506522CD3BA1DF6CA3FC1492A
Submitted as: 30cf8b82a53fff20b564597e56123ddeb16a87441a8b94f621e52c3213aeaa2c.exe
File type: pe · Size: 10752 bytes
Verdict: malicious (98/100) · Family: Phorpiex

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Phorpiex.APX!MTB
Emsisoft (Emergency Kit): Gen:Variant.Worm.Phorpiex.153
Kaspersky (KVRT): HEUR:Trojan-Downloader.Win32.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 11 weighted signals:

Microsoft Defender flagged Trojan:Win32/Phorpiex.APX!MTB (rule Trojan:Win32/Phorpiex.APX!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Worm.Phorpiex.153 (rule Gen:Variant.Worm.Phorpiex.153) - engine signal, weight 0.55, confidence 0.85
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (26 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://178.16.54.109/xmr.exe, http://178.16.54.109/xmrget.exe, http://178.16.54.109/11.exe - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

1556 behavior events · 2 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://178.16.54.109/xmr.exe
http://178.16.54.109/xmrget.exe
http://178.16.54.109/11.exe
http://178.16.54.109/10.exe
http://178.16.54.109/9.exe
http://178.16.54.109/8.exe
http://178.16.54.109/7.exe
http://178.16.54.109/6.exe
http://178.16.54.109/5.exe
http://178.16.54.109/4.exe
http://178.16.54.109/3.exe
http://178.16.54.109/2.exe
http://178.16.54.109/1.exe
http://www.msftconnecttest.com/connecttest.txt

Embedded domains

inference.location.live.net
mail.ru
mxs.mail.ru
yandex.ru
mx.yandex.ru

Embedded IP addresses

178.16.54.109
23.40.52.209
20.42.65.94
57.155.104.224
4.150.223.102
52.123.252.225
74.179.71.159
20.190.167.19
4.230.171.124
172.215.188.225
52.230.59.222
72.154.7.248
52.168.117.171
135.234.160.244
94.100.180.31
150.171.22.17
217.69.139.150
77.88.21.249
23.33.238.104
23.33.238.173
52.110.12.44
74.226.60.120
52.110.12.49
23.33.238.135
23.198.40.44

More Phorpiex samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report