MALICIOUS — 47f99fea6fa680b2cb68bcf08b99347d9e0bb8c9d61e31a16dfdf08e6a898072

MALICIOUS — 47f99fea6fa680b2cb68bcf08b99347d9e0bb8c9d61e31a16dfdf08e6a898072 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Convagent family. 7 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 47f99fea6fa680b2cb68bcf08b99347d9e0bb8c9d61e31a16dfdf08e6a898072
SHA-1: 2b9d0b15742afbec686bd3ef8fcc8f7b26857fca
MD5: 5a1735d7263c53b427005bff7bb8f972
imphash: 4e7f4e9f034d0a9a0d18c7188d0c2390
ssdeep: 192:QpGWcTQvbqFzKbELeHPJYmwJ59u7vcKjf/o8Etm:QLcTQvmFzKbEKH6mwJ5mLf/Am
TLSH: T11D2411CD41B81B67C33A04E51733D95EA297F0E51DAD710A0D9DA03D90C28A3AE66E37
Submitted as: 47f99fea6fa680b2cb68bcf08b99347d9e0bb8c9d61e31a16dfdf08e6a898072
File type: pe · Size: 12498 bytes
Verdict: malicious (100/100) · Family: Convagent

Detections (7 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
ClamAV (daily): Win.Downloader.Upatre-9854858-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Astaroth.psyW!MTB
Emsisoft (Emergency Kit): Trojan.Ppatre.Gen.1
Kaspersky (KVRT): HEUR:Trojan-Downloader.Win32.Convagent.pef

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Downloader.Upatre-9854858-0 (rule Win.Downloader.Upatre-9854858-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

9541 behavior events · 2 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\fcbnaf.exe - 86923a29f303026c47b65d46addabd011dcf05bdcaa0dad1b9638cd599b05470
f5d81da6e6a7ec03631606a626f9106bb18061a12f49a13b2078ed3e07e979dc - f5d81da6e6a7ec03631606a626f9106bb18061a12f49a13b2078ed3e07e979dc
2dfaa4ace8295fff0957616a45937c03ddbe027ac16f789f621f15a83c033759 - 2dfaa4ace8295fff0957616a45937c03ddbe027ac16f789f621f15a83c033759
532fb441935a63d31eb7008f2bbe0dcee8946332fd85f95d23e335aa3cc90c47 - 532fb441935a63d31eb7008f2bbe0dcee8946332fd85f95d23e335aa3cc90c47
5a291253b241b164b7256ccc058eb5a9eada9f284511a64c827253240104ff96 - 5a291253b241b164b7256ccc058eb5a9eada9f284511a64c827253240104ff96

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787739700&P2=404&P3=2&P4=lQanxD3mBLcqAAvnLKjHoRbOOdL8Rvf%2bzGhoxvU8oMg19Xx3J2h%2bRxHXszRAw%2flFdBNH6C9xb0tCFf%2bI1n8QBA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787739745&P2=404&P3=2&P4=KSx%2b63HsYLpeScrkzFfAfCy9loImjAE6W5UHW0m1oIQL3nuONdCps0au0Auc5yKB2jz33fDG%2b5bhyyEd8LDaZA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

huyontop.com

Embedded IP addresses

20.42.65.93
52.230.59.222
4.230.171.124
4.247.188.233
74.179.77.204
20.165.94.54
51.104.15.253
74.178.76.128
20.231.239.246
52.123.129.14
52.123.128.14
52.110.12.32
52.110.12.56
203.26.79.13
20.165.94.46
135.233.45.223
20.42.73.24
52.168.117.175
135.233.45.222
52.148.114.188
92.223.78.30
72.145.35.97
52.110.12.31
52.110.12.14

File paths

C:\xJg4Znp3.exe
C:\9180338b1d36bfff41d5f1a570d7632885796f79156da09d829f3f05b9c37cbf
C:\a33372c7519a1181e119a9c71a2772c2ab503ae5db3047247b604d2aa579c930
C:\d0fd253b90c84be3e80052dd52c714a8f592da9ab82a7b0549e17e86a758c3c9
C:\UBXwxYQh.exe
C:\b6a3a155aa5fd4639e671f0ad489f8736aa73ccbc98f0ea0cbaa37df6032ee14
C:\b28046dd45437229616e701ab657dc396a1ecd85d1457b9a146bd4527a9fa690
C:\xiHWrdi8.exe
C:\Documents
C:\iA_30zn9.exe
C:\c354151fe392f6c21f83578690b1b5e2d60b18aed1ecddd8fc3f88276cca1add
C:\f2b0292fd1aa385909f22de61536d937c1f3602768aa75576a61234847c87b57
C:\733153dce6224396b95494028bcf3878d6832ab6f1d38b0f357a2e2a3abe21f5
C:\Users\luser\Desktop\36Xrf434.exe
C:\50962220f17e9cf81c7923f8935be90d8031f18c413167e53fb0548510f86d7d
C:\7d90e510162f7247eb648d7a957e802e9c9ab3b408ee61c0311bac91fdbada42
C:\77e66756f71eb05da40d884201f66eb7459731972114e2f1e12f8e8742230098
C:\8ab692ee77610eafb2319bd357f4ac06207cc03e0a32df0cb49f8f89266edb83
C:\JzkVjiA_.exe
C:\d2d7Y_kD.exe
C:\Users\luser\Desktop\olqvzj8R.exe
C:\SylpmWoe.exe
C:\Users\luser\Desktop\mYFXSTzy.exe
C:\ASSjmdRB.exe
C:\HSNPlIeq.exe

More Convagent samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report