MALICIOUS — 3564ceb9251eccd82d0c060c0dca83c9812f72c5fb72b5c25443dfd8a780c734

MALICIOUS — 3564ceb9251eccd82d0c060c0dca83c9812f72c5fb72b5c25443dfd8a780c734 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Mikey family. 5 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 3564ceb9251eccd82d0c060c0dca83c9812f72c5fb72b5c25443dfd8a780c734
SHA-1: 0adfe19d8b4d204c9a0fdc4ef5a6329f873393ba
MD5: 70a64ae401c0a5f091b5382dea2432df
imphash: 393639a60c6cd8a32838f37476501ec3
ssdeep: 1536:qiX+ZFk/x7v5G2UcA2GmAyVX+W0lUnYgCsWLPcdgQISuBHTm+f8dGFBpIO1mhSA:qiX5zTUcLGmFxvntUeg9SuBK+fzxmhr
TLSH: T1BB3B9CCD45259788EA728B607D054D2E6017F09A89BEBC2C0E53C53F36A3C9BE87051E
Submitted as: 3564ceb9251eccd82d0c060c0dca83c9812f72c5fb72b5c25443dfd8a780c734
File type: pe · Size: 111616 bytes
Verdict: malicious (100/100) · Family: Mikey

Detections (5 of 51 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
ClamAV (daily): {MD5}bin.trojan.mikey.8797.UNOFFICIAL
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/kerrdown.A!dha
Emsisoft (Emergency Kit): Gen:Variant.Ser.Mikey.1365

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged {MD5}bin.trojan.mikey.8797.UNOFFICIAL (rule {MD5}bin.trojan.mikey.8797.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 4 finding(s), e.g. RWX/private injected region in svchost.exe (pid 964) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/kerrdown.A!dha (rule Trojan:Win32/kerrdown.A!dha) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Ser.Mikey.1365 (rule Gen:Variant.Ser.Mikey.1365) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

22209 behavior events · 2 ATT&CK techniques · 5 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/5121/files/7c3af6806dd71cd513025f155ac5161f306dc72c5375630fdc669d02d3a0f174 - 7c3af6806dd71cd513025f155ac5161f306dc72c5375630fdc669d02d3a0f174
ef4a1ecfeab039f91d46c0816560b798cccea05b7849df39aeb955986d831a7f - ef4a1ecfeab039f91d46c0816560b798cccea05b7849df39aeb955986d831a7f
90c47c558bff0390bbe01803edc22a402c867e43e6fc807659fedfa8765698a2 - 90c47c558bff0390bbe01803edc22a402c867e43e6fc807659fedfa8765698a2
bc334b5eaeafcf4b0dbc7dd204b5cbe239fd01104dd7a1152fc3ee76ddbffd11 - bc334b5eaeafcf4b0dbc7dd204b5cbe239fd01104dd7a1152fc3ee76ddbffd11
003b9e5204a46b2b4fa13ac72ea8918560f5688aae4bde8f5cdd064041de1cdb - 003b9e5204a46b2b4fa13ac72ea8918560f5688aae4bde8f5cdd064041de1cdb

Embedded domains

aefd.nelreports.net
check.webhop.org

File paths

T:\:

More Mikey samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report