MALICIOUS — 47a165ad0d08a3745d55463e87aa7056f25f7fc8fad86fcdbae4b1feddb82fff
MALICIOUS — 47a165ad0d08a3745d55463e87aa7056f25f7fc8fad86fcdbae4b1feddb82fff is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the MSILZilla family. 6 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.
Identification
- SHA-256:
47a165ad0d08a3745d55463e87aa7056f25f7fc8fad86fcdbae4b1feddb82fff - SHA-1:
14a7d794ebfbaf87f71050ea5a7d81633bd882c9 - MD5:
2630f019b97062efe4f95439bbd59012 - imphash:
f34d5f2d4577ed6d9ceec516c1f5a744 - ssdeep:
3072:vBA9scdT/+BIntv0AK9wugxgAaL8GDuXZp6hFpK4FPlQeZeoFTDs/RTLl:vBksnaugxgAaL8GDuXZp6hFH90f - TLSH:
T12C3B3ADD6CDC1714D574AB31390CE6EDA4097C88E9B67F8C1F284A1A2024D3FAD6A44A - Submitted as: 47a165ad0d08a3745d55463e87aa7056f25f7fc8fad86fcdbae4b1feddb82fff
- File type: pe · Size: 104448 bytes
- Verdict: malicious (100/100) · Family: MSILZilla
Detections (6 of 56 engines)
- capa (capabilities): capability:credential-access
- ClamAV (daily): Win.Packed.Lazy-9924677-0
- YARA: Yara-Rules community: YR_AntiVM_Sandbox
- Microsoft Defender: Trojan:Win32/Stealgen.GA!MTB
- Emsisoft (Emergency Kit): IL:Trojan.MSILZilla.17424
- Kaspersky (KVRT): HEUR:Trojan-PSW.MSIL.Disco.gen
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 16 weighted signals:
- ClamAV (daily) flagged Win.Packed.Lazy-9924677-0 (rule
Win.Packed.Lazy-9924677-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Stealgen.GA!MTB (rule
Trojan:Win32/Stealgen.GA!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged IL:Trojan.MSILZilla.17424 (rule
IL:Trojan.MSILZilla.17424) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan-PSW.MSIL.Disco.gen (rule
HEUR:Trojan-PSW.MSIL.Disco.gen) - engine signal, weight 0.55, confidence 0.85 - access stored credentials (rule
access stored credentials) - capa signal, weight 0.50, confidence 0.80 - 1 IDS alert(s): ThreatLens Discord CDN payload/exfil - network signal, weight 0.50, confidence 0.80
- Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - execute via PowerShell (rule
execute via PowerShell) - capa signal, weight 0.40, confidence 0.80 - Contacted 3 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
- YARA: Yara-Rules community flagged YR_AntiVM_Sandbox (rule
YR_AntiVM_Sandbox) - engine signal, weight 0.40, confidence 0.70 - capa (capabilities) flagged capability:credential-access (rule
capability:credential-access) - engine signal, weight 0.35, confidence 0.70 - query domain / anti-analysis (rule
query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: https://discordapp.com/api/v6/users/@me, http://ifconfig.me, https://cdn.discordapp.com/attachments/825091638782459912/889657500192874496/Release.zip - static signal, weight 0.35, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
7274 behavior events · 2 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- mail.google.com
- accounts.google.com
- cdn.discordapp.com
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- windows.msn.com
- odc.officeapps.live.com
Dropped files
- 179cde70089a7d70c2149dad82c12309085a1eee2fa0925b9e6b7bdcfe8fe097 -
179cde70089a7d70c2149dad82c12309085a1eee2fa0925b9e6b7bdcfe8fe097
Embedded URLs
- https://discordapp.com/api/v6/users/@me
- https://mail.google.com
- http://ifconfig.me
- https://cdn.discordapp.com/attachments/825091638782459912/889657500192874496/Release.zip
- https://discord.com/api/webhooks/907787402825846854/HlY-UlzKxoZqpAuwa6BmnqiAjrEUCXC8x76pk1yCYVrHBZJYwdDrE4j1JyimJcyuPkzZ
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
- http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
- http://yr.c.lencr.org/
Embedded domains
- discordapp.com
- gateway.discord.gg
- roblox.com
- mail.google.com
- ifconfig.me
- cdn.discordapp.com
- discord.com
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 1.1.1.1
- 52.182.143.212
- 52.123.252.240
- 4.230.171.124
- 4.247.188.224
- 4.144.132.223
- 135.233.95.144
- 135.232.92.97
- 20.165.94.63
- 20.42.73.26
- 172.64.154.167
- 20.184.175.8
- 64.233.170.84
- 162.159.135.233
- 172.178.240.161
- 52.110.12.56
- 52.110.12.47
- 20.42.179.192
- 20.42.65.94
- 40.79.141.153
- 92.223.78.30
- 172.178.240.162
- 72.145.35.99
- 52.148.114.188
- 52.110.12.4
File paths
- C:\Users\Zotiyac\Desktop\Qvoid-Token-Grabber-main\Qvoid-Token-Grabber-main\Qvoid
- C:\Users\
More MSILZilla samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report