MALICIOUS — 406267eec73ba4301d2bbe89f6b0c2ae5a3d5d5cf0844cce3f20924506986d84

MALICIOUS — 406267eec73ba4301d2bbe89f6b0c2ae5a3d5d5cf0844cce3f20924506986d84 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Vobfus family. 4 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 406267eec73ba4301d2bbe89f6b0c2ae5a3d5d5cf0844cce3f20924506986d84
SHA-1: c0f09b45d942e1e881ec2bbdb49f70092e7fe3f5
MD5: 7b6210d9b86d16bafca90c7e4f809f4e
imphash: 74a700ac5b845069d415423354fd8c51
ssdeep: 768:juDw1owYOWJOaoQldu+XfLIwvoJeSoNw/WW49Oty/N/X+YVhP5itZfP6v+XysP:iDw1owc5frosSDeWSEmNfP8Sv+xP
TLSH: T16C376697BA69DD95C0F2D65B0E482FDEA04C87C47A3B402D06E9664E1CD84FBB814E4C
Submitted as: 406267eec73ba4301d2bbe89f6b0c2ae5a3d5d5cf0844cce3f20924506986d84
File type: pe · Size: 73728 bytes
Verdict: malicious (100/100) · Family: Vobfus

Detections (4 of 56 engines)

ClamAV (daily): Html.Trojan.VBChinky-3
Microsoft Defender: Worm:Win32/Vobfus.AC
Emsisoft (Emergency Kit): Gen:Trojan.Chinky.2
Kaspersky (KVRT): Worm.Win32.Vobfus.exhd

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Html.Trojan.VBChinky-3 (rule Html.Trojan.VBChinky-3) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Worm:Win32/Vobfus.AC (rule Worm:Win32/Vobfus.AC) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Trojan.Chinky.2 (rule Gen:Trojan.Chinky.2) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.Vobfus.exhd (rule Worm.Win32.Vobfus.exhd) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

55876 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Users\analyst\seogoo.exe - 16ee21fbff2d6f3075648a3f09f7892ca56ea34855d10bf4797d26255bff5968
3e87cb93e4874e01eeab7a2262319ae747330f58ff947c338af6744a8bded413 - 3e87cb93e4874e01eeab7a2262319ae747330f58ff947c338af6744a8bded413
eedc21b41035dde242047f46ed2b88b621967e3ffef741341fe726d4a25a490a - eedc21b41035dde242047f46ed2b88b621967e3ffef741341fe726d4a25a490a
109016b2ad39a1d5870be0a30b5f3a7bd08756af5f0b7c0faa2e9d3547720a04 - 109016b2ad39a1d5870be0a30b5f3a7bd08756af5f0b7c0faa2e9d3547720a04

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

ns3.thepicturehut.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.117.170
4.230.171.124
20.42.179.204
48.211.4.16
20.247.185.124
74.178.76.128
135.232.92.97
20.42.72.131
104.18.33.89
20.42.73.27
52.168.112.67
51.116.246.106
52.110.12.22
52.110.12.10
125.56.205.24
125.56.205.32
72.153.5.138
52.148.114.188
52.110.12.48
52.110.12.20

More Vobfus samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report