MALICIOUS — 3aaed41d54409a440b8d6cd693f4bd4c37ba892d28ce6f58fdbb4cdfad594563

MALICIOUS — 3aaed41d54409a440b8d6cd693f4bd4c37ba892d28ce6f58fdbb4cdfad594563 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Vtflooder family. 5 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 3aaed41d54409a440b8d6cd693f4bd4c37ba892d28ce6f58fdbb4cdfad594563
SHA-1: 45b5349d4430bc20d89a91f6a9c71a9860537db6
MD5: 86b7c60f479ab0471d0c85b53fbd25d4
imphash: cf533625af448ad22653a182bf083f59
ssdeep: 384:bx02c+NiNMhaS9MySYitL93lppji83C8ARDr3QfTQkNEExIstAv3ATefCiigrcL0:62XiNCR9MLYWi8JsOOstAv3ATec460tT
TLSH: T1B22BF7DFA224A464D511AF2387D149FC103FB869D2A2534A3C83CE1A6FD0C7B95B950A
Submitted as: 3aaed41d54409a440b8d6cd693f4bd4c37ba892d28ce6f58fdbb4cdfad594563
File type: pe · Size: 22204 bytes
Verdict: malicious (100/100) · Family: Vtflooder

Detections (5 of 56 engines)

ClamAV (daily): Win.Malware.Vtflooder-6725383-1
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Trojan.Agent.BYFH
Trellix Stinger (McAfee): Agent-FEU!86B7C60F479A
Kaspersky (KVRT): Trojan-Spy.Win32.Agent.cpyi

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Vtflooder-6725383-1 (rule Win.Malware.Vtflooder-6725383-1) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.BYFH (rule Trojan.Agent.BYFH) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Agent-FEU!86B7C60F479A (rule Agent-FEU!86B7C60F479A) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Spy.Win32.Agent.cpyi (rule Trojan-Spy.Win32.Agent.cpyi) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 13 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

34058 behavior events · 2 ATT&CK techniques · 8 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA - a99b0491f4bdd8b44cf8073b5b827a6b81a2b0c9cbf04692cfa037e1cd74531b
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199 - a6f8f5d4ffd1e825ffce9a55861f16aa4dbe67871b1696b976194dd8be1fdf29
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199 - fe5ee11016a4d6a50aa82414927cc75aa9b4d94e10bf286e263b392aaf306f9f
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA - a2b748291b053d4a4397b78107e95ca54a5bd9791dd8f2442558a71a00edbbaa
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75A092F4522006A97542D6AC4F4E69D2 - 3ec4b2fff804fa4bb1e25fdee37314b9b438c0ee474207e9178d6668e6170cd5
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\71D3A36027B1506445FB345FD67207AC - 2302381fadff2a7e0a1fee7cc8d21ee7f792e9104ca3605dba27da67f7b66553
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75A092F4522006A97542D6AC4F4E69D2 - 18ca2188ad32f8a78fb2044e990ac544b786b1ca182539d582c18565b0f99e27
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\71D3A36027B1506445FB345FD67207AC - e4585c4e85d4a8d430a19c1d7af74d6fd8e5093fe74422237c03d111c2f54f77

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://google.com/
http://c.pki.goog/r/r1.crl
http://c.pki.goog/wr2/oBFYYahzgVI.crl
http://www.virustotal.com/vtapi/v2/file/scan
http://c.pki.goog/wr3/MbJBMFoQ-sk.crl

Embedded domains

a6281279.yolox.net
www.virustotal.com

Embedded IP addresses

20.184.175.4
52.230.59.222
4.230.171.124
52.110.12.15
52.110.12.42
34.54.88.138
172.66.2.5
51.116.246.104
172.215.188.232
52.110.12.2
52.110.12.14
52.148.114.188
72.145.35.110

More Vtflooder samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report