MALICIOUS — 4656d8f47c7abc2ab93c91240c05f4621848c6be453ea5990a35fce21e4836cf

MALICIOUS — 4656d8f47c7abc2ab93c91240c05f4621848c6be453ea5990a35fce21e4836cf is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Delf family. 6 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 4656d8f47c7abc2ab93c91240c05f4621848c6be453ea5990a35fce21e4836cf
SHA-1: d8ae42f0b151f986c4394a8ca8d56bdc67f971c1
MD5: 2fb7a2f5ed52bef8f06c1e005adf44b1
imphash: 842ba1c2436dd1a931cfdde74fd7ef17
ssdeep: 768:NiOQauOECLIK8u4qc+5aIjK4LrP+K5fE67y7N8FdUV0MeExZ6Tj8UP3P:Nip8JB5aOLL+K5E6U878XUP3P
TLSH: T12D348D361F2F2F1BEA7AD66788016A5E0862BCB934D50448D71FA8BD73EEC03685111D
Submitted as: 4656d8f47c7abc2ab93c91240c05f4621848c6be453ea5990a35fce21e4836cf
File type: pe · Size: 52545 bytes
Verdict: malicious (99/100) · Family: Delf

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:DATA
ClamAV (daily): Win.Trojan.Gobot-20
YARA: Stratosphere IPS: STRATO_IRC_Botnet
Microsoft Defender: Backdoor:Win32/Delf.BA!MTB
Emsisoft (Emergency Kit): Gen:Trojan.IRC-Backdoor.dGX@aSF4T5g
Kaspersky (KVRT): Backdoor.Win32.Delf.ma

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Trojan.Gobot-20 (rule Win.Trojan.Gobot-20) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 4 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 48 external host(s) at runtime (15 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Stratosphere IPS flagged STRATO_IRC_Botnet (rule STRATO_IRC_Botnet) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-sections:DATA - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

238 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Windows\ZyaC3o6BphZCT.exe - 5dde0d8a64e60d8524c891280754d08ee7e5d4ec53d28f425e2794accea65f19

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded IP addresses

4.150.223.104
52.123.252.227
4.247.188.224
4.230.171.124
20.247.184.197
74.178.76.128
4.150.223.114
74.179.77.164
20.76.201.171
52.123.129.14
52.123.128.14
129.27.9.247
213.188.157.221
47.110.95.42
213.64.84.91
192.169.233.136
63.88.87.111
161.224.209.145
207.183.85.253
95.179.40.116
120.33.120.64
210.213.92.17
60.180.13.218
57.114.247.59
194.253.133.217

More Delf samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report