MALICIOUS — 071_EarthKrahang_20240404.bin

MALICIOUS — 071_EarthKrahang_20240404.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Shadowpad family. 4 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 4529f3751102e7c0a6ec05c6a987d0cc5edc08f75f287dd6ac189abbd1282014
• SHA-1: 86e5a47f050a33894502830215472bf7e6531c9d
• MD5: f4693d792c0edbcc3ed62bf8222a3aca
• imphash: 44af9e9895a06884e7aa562f1682f89d
• ssdeep: 1536:5Vb22oJHfFKO4czJLJWBtHDP4Kmu04A19A4zIoFeiLpTfYR/uO:KFGWhw7EKcbK58wRm
• TLSH: T1BC3AB042CD1A5245F3BAD6407C046F0E50B29EAE52FE297C0783EE2E67EB4D7B462045
• Submitted as: 071_EarthKrahang_20240404.bin
• File type: pe · Size: 100864 bytes
• Verdict: malicious (97/100) · Family: Shadowpad

Detections (4 of 51 engines)

• ClamAV (daily): {MD5}bin.loader.shadowpad.7432.UNOFFICIAL
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Trojan:Win32/Malgent!MSR
• Emsisoft (Emergency Kit): Gen:Variant.Fragtor.437900

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 97/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged {MD5}bin.loader.shadowpad.7432.UNOFFICIAL (rule {MD5}bin.loader.shadowpad.7432.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/Malgent!MSR (rule Trojan:Win32/Malgent!MSR) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Fragtor.437900 (rule Gen:Variant.Fragtor.437900) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

45 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• searchapp.bundleassets.example
• inference.location.live.net
• desktop-hsgcbep
• v10.events.data.microsoft.com
• config.edge.skype.com
• settings-win.data.microsoft.com
• login.live.com
• www.bing.com
• fd.api.iris.microsoft.com
• windows.msn.com
• officeclient.microsoft.com
• licensing.mp.microsoft.com
• msedge.api.cdp.microsoft.com
• dns.msftncsi.com
• g.live.com
• ecs.office.com
• assets.msn.com
• self.events.data.microsoft.com
• watson.events.data.microsoft.com

Embedded domains

• inference.location.live.net
• aefd.nelreports.net

More Shadowpad samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report