SUSPICIOUS — mutated_19915.exe

SUSPICIOUS — mutated_19915.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (64/100), attributed to the AntiDebug family. 3 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 3fb845ec7edf8d2a4addfc4d62e32c95e400afd3801232c1e4155f7eacbd1650
SHA-1: 7de7235003131ace57c72da76d324d4ca7111f22
MD5: 4eae715a5c1e3acc98c9435c39ce6daf
imphash: 542863a264e826bf130b0880664f67e4
ssdeep: 98304:l7GpL4IFkDS1foMqv4Yop7IyoB+QBPDE7ux:l7GpZ31foMqtB+QBPDEa
TLSH: T1156A6C7071656487CFFA1630BCAE456E37B360202AB6D38C1386215391D26FF8A7C5E6
Submitted as: mutated_19915.exe
File type: pe · Size: 9807980 bytes
Verdict: suspicious (64/100) · Family: AntiDebug

Detections (3 of 55 engines)

YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/Zusy.KK!MTB
Kaspersky (KVRT): HEUR:Trojan.Win32.Agent.pef

MITRE ATT&CK

T1105

Why this verdict

The suspicious score of 64/100 is the fusion of 4 weighted signals:

Contacted 28 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://gcc.gnu.org/bugs/ - static signal, weight 0.35, confidence 0.60
Dropped 7 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

283 behavior events · 0 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\mutated_16104.exe - f65e8d05c8e9f69150247ef2a6f7c6d07769218c0fd26c1ebb6e808178d830fa
C:\Users\analyst\AppData\Local\Temp\mutated_29285.exe - 3a787acb428ee2481623e022f5b454f7c1fd80b98484a925aea2cf982f58c2f8
C:\Users\analyst\AppData\Local\Temp\mutated_17653.exe - 6720ca0767543aaebfe07f621fe6163ff0d5eb327138bad8e7044c9efd131a2d
C:\Users\analyst\AppData\Local\Temp\mutated_6897.exe - d105c43399600c73b75b5c53be2b430d8073a691308a17a2a9547b59836c6770
C:\Users\analyst\AppData\Local\Temp\mutated_13551.exe - 843c5d7fe3261d9250bb42142ae50eb4edd04a3b06384f74a214c6f5e3a1ad71
C:\Users\analyst\AppData\Local\Temp\mutated_17546.exe - 949e16cd2bfe04c77e452eee163e5ccf72efb7b81d1ab272c20498f66ac37d03
C:\Users\analyst\AppData\Local\Temp\mutated_20205.exe - 6bc61d956da10ddf58e261f2a984d9a73ade8cdc2349ba5f5fffec71fb138b8e

Embedded URLs

https://gcc.gnu.org/bugs/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787658665&P2=404&P3=2&P4=kB4rvW0H2QWiIsAGucmZU3lggebtZE4VF6I9lczgABnp7OwpbRHXKQYlluaFLLIMZV%2f3nIHn0fzEDQpUE4hSzw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787658687&P2=404&P3=2&P4=Y29UfVr0GLGubef2KbNG4aBA%2bGDK15XqLz6dQdv9qnAMVspakyIX9Ei9KnMcpqbLJJoElJa7O2hi3IqLGQfQVQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

gcc.gnu.org

Embedded IP addresses

135.232.92.34
142.250.195.99
52.123.252.235
20.184.175.6
4.230.171.124
40.84.97.4
52.253.84.76
74.178.76.128
52.123.252.213
135.233.95.135
52.178.17.3
203.26.79.13
52.123.252.230
52.123.128.14
20.236.44.162
52.123.129.14
52.123.252.212
104.208.16.94
172.178.240.162
20.165.94.63
92.223.78.30
52.110.12.14
52.110.12.31
135.234.160.245
52.148.114.188

File paths

X:\:`:d:h:l:p:t:x:
X:\:h:l:p:

More AntiDebug samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report