MALICIOUS — 3a20be74a262beda5e6199cb54146a1b3e72a921f1218d248b836ac4a008bc89

MALICIOUS — 3a20be74a262beda5e6199cb54146a1b3e72a921f1218d248b836ac4a008bc89 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Infostealer family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 3a20be74a262beda5e6199cb54146a1b3e72a921f1218d248b836ac4a008bc89
SHA-1: 1d9a69158070fb361205d7b8e3f16d8ef4a620a9
MD5: 8073c38b05294675db72ce2e46768add
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 192:DBksu/EXVwVCieMZZ3H93VnjdwCzN3wQYb:xVwsieM5FnhwCBAr
TLSH: T197221AEF1A185E43DB7AD41B6105C97EB490749E28F2228D02048B33553C833987E7EB
Submitted as: 3a20be74a262beda5e6199cb54146a1b3e72a921f1218d248b836ac4a008bc89
File type: pe · Size: 9728 bytes
Verdict: malicious (100/100) · Family: Infostealer

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Msilkrypt-9839010-0
Microsoft Defender: PWS:MSIL/Infostealer.PAC!MTB
Emsisoft (Emergency Kit): Gen:Variant.Jalapeno.330
Kaspersky (KVRT): HEUR:Trojan.MSIL.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Msilkrypt-9839010-0 (rule Win.Malware.Msilkrypt-9839010-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged PWS:MSIL/Infostealer.PAC!MTB (rule PWS:MSIL/Infostealer.PAC!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Jalapeno.330 (rule Gen:Variant.Jalapeno.330) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.MSIL.Agent.gen (rule HEUR:Trojan.MSIL.Agent.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 14 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
Extracted RedLine config (0 C2) - engine signal, weight 0.45, confidence 0.60
Embedded network infrastructure: http://tempuri.org/IUserService/GetUsersT, http://194.87.145.184:6484/UserService, 194.87.145.184 - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

3935 behavior events · 2 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://tempuri.org/IUserService/GetUsersT
http://194.87.145.184:6484/UserService
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

schemas.datacontract.org
tempuri.org

Embedded IP addresses

194.87.145.184
52.123.252.242
20.184.175.10
20.247.184.197
4.230.171.124
85.210.193.152
20.165.94.63
4.150.223.110
74.178.76.54
20.236.44.162
52.123.128.14
52.123.129.14
40.99.134.18
40.99.133.242
20.184.175.22
135.234.160.246
20.42.65.85
203.26.79.13
72.145.35.103
74.178.232.29
52.110.12.15
172.66.2.5
52.148.114.188
52.110.12.10

More Infostealer samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report