MALICIOUS — 4aa0fa1f4cfe502bd71d415b0cca5dd3070f1d60596eff8729c1ca245b13fb43

MALICIOUS — 4aa0fa1f4cfe502bd71d415b0cca5dd3070f1d60596eff8729c1ca245b13fb43 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Autoit family. 7 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 4aa0fa1f4cfe502bd71d415b0cca5dd3070f1d60596eff8729c1ca245b13fb43
SHA-1: cab58a3bbdde295f7b704dab7abfb5902c7b73c5
MD5: 5ad0c8949d6f7b726b70706fb07f2e08
imphash: 6ff9090e682b22c5107bfaa71e5ff375
ssdeep: 98304:dE35cE35aE35cE35CE35cE35hE35cE35dE35cE35BE35cE35RE35cE35hE35cE33:V
TLSH: T11B6923D5D6381122CBED97214E199A2EADC4587B005EA436F121B13E0BED8B358B4DF3
Submitted as: 4aa0fa1f4cfe502bd71d415b0cca5dd3070f1d60596eff8729c1ca245b13fb43
File type: pe · Size: 8471262 bytes
Verdict: malicious (100/100) · Family: Autoit

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Autoit-6981134-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: TrojanDropper:Win32/Pistolar!pz
Emsisoft (Emergency Kit): Gen:Trojan.Heur.AutoIT.10
Kaspersky (KVRT): IM-Worm.Win32.Sohanad.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Autoit-6981134-0 (rule Win.Malware.Autoit-6981134-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged TrojanDropper:Win32/Pistolar!pz (rule TrojanDropper:Win32/Pistolar!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Trojan.Heur.AutoIT.10 (rule Gen:Trojan.Heur.AutoIT.10) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged IM-Worm.Win32.Sohanad.gen (rule IM-Worm.Win32.Sohanad.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 1 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1,.bldvar,BSS, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 17 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

42658 behavior events · 0 ATT&CK techniques · 20 dropped files.

Dropped files

C:\$Recycle.Bin.exe - 3268c377923b4a8c1ad629b71c4c4453a1a9c835611433e1732af38e98d217ce
C:\Windows\Driver.db - b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
C:\Users.exe - eb74b983254e014a327459f876f6bc37fd6fa0399c82d436914233b424e4bf2b
C:\$WinREAgent.exe - c8b1892ec1674ae5ac3f49e7c041137d7a820fc59374f64fa0f6dd94ec4ff3b1
C:\Windows\svhost.exe - 994133a3bd8cfefa3c893e095d9984c08eeb198edf58f2855f66ab63132a6591
C:\inetpub.exe - f507985654e5061a453aafd4555472b6bae752d7cb6f2dd787ebb89b10278965
C:\System Volume Information.exe - 810164f44acf8dd396d3540961a7ddd18d3c11a160bab0d45a8564934a5dd2c9
C:\PPLFaultTemp.exe - 819965095c930f1dce0db5bca4e286c7ecc26086d8862e7fd641ea36a6de53ea
623950262c04ae4c276b06e6cfc0c04c41d6605169beb00905bf11f51a1b1de4 - 623950262c04ae4c276b06e6cfc0c04c41d6605169beb00905bf11f51a1b1de4
C:\ProgramData.exe - 46b5db38107f03089d915560a644a1b13d1abc24e620036611f40474d9f7becf
C:\Documents and Settings.exe - 71bd3464e304cf62f64140bcc2c4a8c125552cf4f3fd74062640922b0e4723f6
C:\Windows.exe - 37654e50406ce6f20527b93a56924e67d42bcb75ffc33080a99f2d71fed18157
C:\ThreatLens.exe - a127ea90a5db0e4733639b134325054abfda51908289804b1a65a98e8196b02d
C:\Config.Msi.exe - 071beae036650f043ab21f5d5c9fc4efd8f7f49cd0f6f3cab778428b3da2b7f1
C:\Python3.exe - 2305ec0156987d2c79cec1b44ef7711d87119094425cb90faa47cefbaf67d816

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.65.93
52.123.252.222
4.230.171.124
57.154.63.210
20.247.185.124
74.178.76.128
135.232.92.97
40.79.141.153
20.42.73.24
52.110.12.28
52.110.12.8
92.223.78.30
125.56.205.32
125.56.205.42
72.154.7.112
52.148.114.188
52.110.12.46
52.110.12.52

More Autoit samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report