MALICIOUS — 360d206f1739e0b6bcba17aa4db9c48f2fbb5503df85c077ee3b7d3879a035b6

MALICIOUS — 360d206f1739e0b6bcba17aa4db9c48f2fbb5503df85c077ee3b7d3879a035b6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fileinfector family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 360d206f1739e0b6bcba17aa4db9c48f2fbb5503df85c077ee3b7d3879a035b6
SHA-1: aef5a1692408c0bac91525f956cbe175ab45e66c
MD5: 3f4f899d938d27c7b51a6767684a0d7d
imphash: 895fbb56c02c3d2bca3125cef5da8730
ssdeep: 384:GTe/Or4vMy/xTe/OmxDMmkhCWRGMAWd6+WzSnsu5VpBj:ae2qle2mxDMm+xYTSsud
TLSH: T19536A6D5306A3310DDF0F458AE14986DB5A2ACA6233737E82801C17F74B57F756B882A
Submitted as: 360d206f1739e0b6bcba17aa4db9c48f2fbb5503df85c077ee3b7d3879a035b6
File type: pe · Size: 69632 bytes
Verdict: malicious (100/100) · Family: Fileinfector

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Fileinfector-9832954-0
Detect It Easy (packer/type): DIE:MinGW
Microsoft Defender: Trojan:Win32/Vindor!pz
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Fileinfector-9832954-0 (rule Win.Malware.Fileinfector-9832954-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Vindor!pz (rule Trojan:Win32/Vindor!pz) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.ks (rule Virus.Win32.Lamer.ks) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 21 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MinGW (rule DIE:MinGW) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, MinGW - static signal, weight 0.25, confidence 0.55
Dropped 23 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

96354 behavior events · 2 ATT&CK techniques · 38 dropped files.

Dropped files

C:\Windows\System32\vcruntime140.dll - 57650a6ffe2a4ca16505a2be0754d0bbeb7a59f8c4a940fb7dd5e9d92a65623d
C:\Windows\win.ini - fad2babc3b7809fca0b5d147a970ba24b66ddad0b2f41797a4dda6fe8c522644
C:\Windows\pyshellext.amd64.dll - f887933ce3ddc7bd8cec5c2f21ca61d756f1e0a4013c0c61fb7a9cc09a11e610
C:\Windows\System32\PrintConfig.dll - 248b526c6f5262a605fa66298d947500c41ac46b9944850b8de2c43d916dbab9
C:\Windows\System32\NOISE.DAT - 6a25cafe08bac8d2cc09c0abf5878ee0a7c8085ca1f1bba1a729ab9c579f8646
C:\Windows\System32\msvcp140_1.dll - 6fae4420449128641b95c90e472bcff4e04602837f453e355a5880f21cea10cd
C:\Windows\System32\debug.log - 50fd545f358258e2faee3736c1ddb4ac6ae99fcad2e8dd0e382243f9c3674945
C:\Windows\System32\mmc.exe.config - a0b3172f3919818d52b5538046bd0490ec5fa9e066df70a27e2b3605fbe566f0
C:\Windows\DtcInstall.log - c1aad063ed27ac7a66b288868eeb55a1fd693fd69de42de2e0dfa207a0dff10a
C:\Windows\setuperr.log - 245824cf0d842ea3f5b1a846e1646a27ee4b367ff7b43bbb54565103439d2b24
C:\Windows\SysmonDrv.sys - 7ae7f0a7e6b3863927555fa205d6b947b47f9e3dc1b93508cca8877ba793f05b
C:\Windows\System32\vcruntime140_threads.dll - b4844cbebbd61c0f79084c2922cf12701caf15ffea81a96be65e6ee4ac6569a1
C:\Windows\System32\msvcp140_atomic_wait.dll - f81f2f98c1c18edbfb2f478f01406bd7ef6b60a605b4258bf17b24c615b985bf
C:\Windows\setupact.log - 0f496e41ccb941a5fdeda894cc95b91c05bfa5a939a723cc16fbb9c6cb3a09f9
C:\Windows\System32\vcomp140.dll - 0db7846276b316a099cff2bc524455a00326c98dc7d386036151ef7633b359ba

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://203.26.79.13/filestreamingservice//files/afb4c1e7-5ab6-4274-bbe6-fa4639876844/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/afb4c1e7-5ab6-4274-bbe6-fa4639876844?P1=1787350513&P2=404&P3=2&P4=hPXnleCiB9KFQ4NRbqYeeghmod3YwFu3rr9u1dSWiMPau3fH8ayNmoxsXeGYw0HQYtbTaDTHKbjAVSOC%2b0lU%2bA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf?P1=1787354299&P2=404&P3=2&P4=ElLaAGSqvHE%2fud1oOy9cHTUmePvNSsovOeUG0kb6%2bBU6%2b%2bMYS0cpPMllI2X7kLzG0p4YKwEcdFNAK2Q5UFj2GA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.microsoft.com
www.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.65.90
20.247.185.124
52.123.252.223
4.230.171.124
74.178.76.54
20.42.179.204
4.150.223.107
135.232.92.137
162.159.142.9
104.18.33.89
85.210.196.11
135.234.160.246
4.209.250.170
52.168.117.171
203.26.79.13
20.184.175.13
104.46.162.229
52.148.114.188
92.223.78.30
52.110.12.37
72.153.5.129
52.110.12.31

More Fileinfector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report