MALICIOUS — 47dd09950d1535723a948a82eba4c27578a65ef9a1f71284aca1804ec0f9f731

MALICIOUS — 47dd09950d1535723a948a82eba4c27578a65ef9a1f71284aca1804ec0f9f731 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the ShellHook family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: 47dd09950d1535723a948a82eba4c27578a65ef9a1f71284aca1804ec0f9f731
• SHA-1: c17e9f0e52ece06d709e2eca30874553e25f47dc
• MD5: 63ca1606fcf559564d04ac419f71492a
• imphash: 3aaa695d4cef53dba5414d0aa4e6b26e
• ssdeep: 3072:f8RhgAWIY3Lab0j1pnw8Zr97TeKIN2nj:U9e3nw+5TxI0
• TLSH: T1A9417E3D062B2B53D777C6240D00BB4E4462F8BA14A991889767C47C77EBCB36B9066C
• Submitted as: 47dd09950d1535723a948a82eba4c27578a65ef9a1f71284aca1804ec0f9f731
• File type: pe · Size: 193820 bytes
• Verdict: malicious (99/100) · Family: ShellHook

Detections (5 of 56 engines)

• ClamAV (daily): Win.Trojan.ShellHook-2
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Worm:Win32/Fasong!pz
• Emsisoft (Emergency Kit): Gen:Variant.Zusy.435974
• Kaspersky (KVRT): Trojan-GameThief.Win32.Lmir.ans

MITRE ATT&CK

• T1071.001
• T1057
• T1112

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

• ClamAV (daily) flagged Win.Trojan.ShellHook-2 (rule Win.Trojan.ShellHook-2) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Worm:Win32/Fasong!pz (rule Worm:Win32/Fasong!pz) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Zusy.435974 (rule Gen:Variant.Zusy.435974) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Trojan-GameThief.Win32.Lmir.ans (rule Trojan-GameThief.Win32.Lmir.ans) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

268 behavior events · 1 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• licensing.mp.microsoft.com
• config.edge.skype.com
• windows.msn.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• assets.msn.com
• www.bing.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• www.msftconnecttest.com/connecttest.txt

Dropped files

• C:\filedebug - 52e41986bd7c6e183ec982ad04233234901e302ae236aaf4ec7b197834c7f080

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded IP addresses

• 52.168.117.171
• 20.247.184.197
• 4.230.171.124
• 52.110.12.50
• 52.110.12.54

File paths

• c:\bbcct.exe
• c:\filedebug
• c:\bbcct.

More ShellHook samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report