MALICIOUS — photov_593373192028.lnk

MALICIOUS — photov_593373192028.lnk is a lnk sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the Ravartar family. 3 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 391cbbd946b4a392519f9d828f9a3e390816cedd2f8318c0e4b39ed25ee4c220
• SHA-1: c713e3e504c61a08b4e7cfed0665b1b32b693b96
• MD5: e0e92b2a401f13ee3316a96568f9d2e5
• ssdeep: 24:8EC11mum+699GJI9Q996ZfZ040TxcUaXn6oR+XINqCUH4I0wVmOV4I0yEqXW:8EKf6mJoQaZfZHne4NqCUYImOqIG
• TLSH: T15E16CACE0A5C03BDC335C4EC4131A1EE0449B0BA04BD79056E9988751603847FDF2F94
• Submitted as: photov_593373192028.lnk
• File type: lnk · Size: 2724 bytes
• Verdict: malicious (94/100) · Family: Ravartar

Detections (3 of 51 engines)

• Microsoft Defender: Trojan:Win32/Ravartar!rfn
• Emsisoft (Emergency Kit): Trojan.Generic.40346808
• Kaspersky (KVRT): HEUR:Trojan.WinLNK.Agent.gen

MITRE ATT&CK

• T1543.003
• T1112

Why this verdict

The malicious score of 94/100 is the fusion of 6 weighted signals:

• Microsoft Defender flagged Trojan:Win32/Ravartar!rfn (rule Trojan:Win32/Ravartar!rfn) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Generic.40346808 (rule Trojan.Generic.40346808) - engine signal, weight 0.55, confidence 0.85
• Shortcut launches: powershell - static signal, weight 0.50, confidence 0.80
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

12816 behavior events · 2 ATT&CK techniques · 11 dropped files.

Runtime network

• none

Dropped files

• /opt/CAPEv2/storage/analyses/5641/files/6266e7c1afdb5ff197bc11f42cfc7e3b15a8b285ff61d344498de9cf448d01f5 - 6266e7c1afdb5ff197bc11f42cfc7e3b15a8b285ff61d344498de9cf448d01f5
• /opt/CAPEv2/storage/analyses/5641/files/22673a0647b9b4e401152fc3fa92f1de2fa0b3e1ec0197cc171d1a6c199dd4e7 - 22673a0647b9b4e401152fc3fa92f1de2fa0b3e1ec0197cc171d1a6c199dd4e7
• /opt/CAPEv2/storage/analyses/5641/files/96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
• 1c0c43709fef59843d066059a3a2c5a614cb531c22b3ee038a75be54e8603fac - 1c0c43709fef59843d066059a3a2c5a614cb531c22b3ee038a75be54e8603fac
• 20e246066b8b809c06a7970f6215bd505430cb992ffac887ccc230362fa8b01e - 20e246066b8b809c06a7970f6215bd505430cb992ffac887ccc230362fa8b01e
• 17af0727919caad20c803f46c0eee55956586ddbd9e30412000c0bac6a8498c6 - 17af0727919caad20c803f46c0eee55956586ddbd9e30412000c0bac6a8498c6
• f282ed09b0b4e75684d68cb8bda35e40a65e066b2f9bf953ef5e3a95d5990062 - f282ed09b0b4e75684d68cb8bda35e40a65e066b2f9bf953ef5e3a95d5990062
• a71c68adc88696120ef58c1235d522db5d980526775d1400a234f8fc168eee1e - a71c68adc88696120ef58c1235d522db5d980526775d1400a234f8fc168eee1e
• 3f96d32951a78429947751db62278d2c36530570f67145d4fdd809c02dab429c - 3f96d32951a78429947751db62278d2c36530570f67145d4fdd809c02dab429c
• 161e61ca4a6261ee02e8da3231071e9a276c38a74154f9dbaf2eae60e5aefab9 - 161e61ca4a6261ee02e8da3231071e9a276c38a74154f9dbaf2eae60e5aefab9
• 1c5cd2ea8a625b7244bfada2ca908de47c8e352a13a0efe2c7d25aa9aa719186 - 1c5cd2ea8a625b7244bfada2ca908de47c8e352a13a0efe2c7d25aa9aa719186

More Ravartar samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report