MALICIOUS — 3ab319d1d70f3e496791bfadfec7f375adb37ff5e27e8f11b16bcf7521e39f50
MALICIOUS — 3ab319d1d70f3e496791bfadfec7f375adb37ff5e27e8f11b16bcf7521e39f50 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Ausiv family. 8 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.
Identification
- SHA-256:
3ab319d1d70f3e496791bfadfec7f375adb37ff5e27e8f11b16bcf7521e39f50 - SHA-1:
0d02028d4c8a6b37dcf7e1047a9a7aa45d0f8027 - MD5:
c0ce80527a67f66d2cb5c3906952a511 - imphash:
c313ec5bc014b38b6853e96d5118bff0 - ssdeep:
12288:tenVPYZs8/ocEU866w0B2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63j:teVPX8/BESGB2uJ2s4otqFCJrW9FqvSn - TLSH:
T1BE4C8D1972D2B2AAF4B2BB1034E08F5D1063F44A21B658481783D4AF67F5D6BC4FA349 - Submitted as: 3ab319d1d70f3e496791bfadfec7f375adb37ff5e27e8f11b16bcf7521e39f50
- File type: pe · Size: 522906 bytes
- Verdict: malicious (99/100) · Family: Ausiv
Detections (8 of 55 engines)
- YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
- capa (capabilities): capability:collection/keylog
- ClamAV (daily): Win.Malware.Ausiv-9940816-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- LIEF (executable format parser): lief:invalid-authenticode
- Microsoft Defender: Trojan:Win32/Hijacker.A!MTB
MITRE ATT&CK
YARA
- Windows_Injection_Api_Combo
Why this verdict
The malicious score of 99/100 is the fusion of 12 weighted signals:
- ClamAV (daily) flagged Win.Malware.Ausiv-9940816-0 (rule
Win.Malware.Ausiv-9940816-0) - engine signal, weight 0.90, confidence 0.95 - Process injection API combination (rule
Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule
TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - LIEF (executable format parser) flagged lief:invalid-authenticode (rule
lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70 - query domain / anti-analysis (rule
query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: http://www.vmware.com/0, 9.0.16.0 - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - inject code into another process (rule
inject code into another process) - capa signal, weight 0.12, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.mozilla.org/MPL/
- http://crl.thawte.com/ThawtePremiumServerCA.crl0
- http://crl.verisign.com/tss-ca.crl0
- http://crl.thawte.com/ThawteCodeSigningCA.crl02
- https://www.verisign.com/rpa
- https://www.verisign.com/rpa0
- https://www.verisign.com/cps0*
- http://logo.verisign.com/vslogo.gif0
- http://crl.verisign.com/pca3.crl0
- http://www.vmware.com/0
Embedded domains
- www.mozilla.org
- crl.thawte.com
- crl.verisign.com
- www.verisign.com
- csc3-2009-2-crl.verisign.com
- csc3-2009-2-aia.verisign.com
- logo.verisign.com
- crl.microsoft.com
- www.vmware.com
Embedded IP addresses
- 9.0.16.0
File paths
- e:\fx19rel\WINNT_5.2_Depend\mozilla\obj-fx-trunk\nsprpub\pr\src\nspr4.pdb
- U:\:m:
- X:\:`:d:h:l:p:t:x:
- C:\cuckoo\
- C:\Documents
- X:\:`:
- V:\:f:
- X:\:
- d:\build\ob\bora-576398\bora-vmsoft\build\release-x64\crosstalk\windows\wnet\amd64\vmci.pdb
More Ausiv samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report