MALICIOUS — bea95bebec95e0893a845f62e832d7cf.exe.ViR
MALICIOUS — bea95bebec95e0893a845f62e832d7cf.exe.ViR is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the VBInject family. 5 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
4de43073c112cf665ab5c3c930fedb747c435625c93b3775a4b2da5f7e736733 - SHA-1:
5f1f00e5ec9f2749bd0a9b86d15c16c1060f6325 - MD5:
bea95bebec95e0893a845f62e832d7cf - imphash:
4ab132a12948f33e7c5a471369279fe5 - ssdeep:
1536:6pgpHzb9dZVX9fHMvG0D3XJcMZxshYdgOzLXehOTJHCyScYFwv5SZUsZMegnT8:4gXdZt9P6D3XJcMXhWaJi7maRgo - TLSH:
T1743BF1C7D204FA87E6EAC6539CC28D1F8237286A13B90AC545F7404E7DE446BF06A5A0 - Submitted as: bea95bebec95e0893a845f62e832d7cf.exe.ViR
- File type: pe · Size: 102607 bytes
- Verdict: malicious (99/100) · Family: VBInject
Detections (5 of 51 engines)
- MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
- ClamAV (daily): {MD5}bin.trojan.zusy.9349.UNOFFICIAL
- Detect It Easy (packer/type): DIE:Microsoft Linker
- Microsoft Defender: VirTool:Win32/VBInject.gen!JD
- Emsisoft (Emergency Kit): Trojan.Dropper.Agent.WGG
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 10 weighted signals:
- ClamAV (daily) flagged {MD5}bin.trojan.zusy.9349.UNOFFICIAL (rule
{MD5}bin.trojan.zusy.9349.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged VirTool:Win32/VBInject.gen!JD (rule
VirTool:Win32/VBInject.gen!JD) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Dropper.Agent.WGG (rule
Trojan.Dropper.Agent.WGG) - engine signal, weight 0.55, confidence 0.85 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule
DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://nsis.sf.net/NSIS_Error - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Dynamic analysis (windows)
90769 behavior events · 2 ATT&CK techniques · 19 dropped files.
Runtime network
- www.msftconnecttest.com
- searchapp.bundleassets.example
- linetechservice.org
- serviceonline2013.org
- servicewebcheck.org
- desktop-hsgcbep
- config.edge.skype.com
- www.bing.com
- watson.events.data.microsoft.com
- g.live.com
- dns.msftncsi.com
- self.events.data.microsoft.com
- go.microsoft.com
- edge.microsoft.com
- aefd.nelreports.net
- www.msftncsi.com
- time.windows.com
- settings-win.data.microsoft.com
- licensing.mp.microsoft.com
- tsfe.trafficshaping.dsp.mp.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/5094/files/c17bb0bea1b0eb101503b8c890be0a395057fbc2c7183864d2ee178f57aa4fff -
c17bb0bea1b0eb101503b8c890be0a395057fbc2c7183864d2ee178f57aa4fff - /opt/CAPEv2/storage/analyses/5094/files/c44a22c3498393a89472f0cbc49d65813ce190da040f41b66acd042669652e5f -
c44a22c3498393a89472f0cbc49d65813ce190da040f41b66acd042669652e5f - /opt/CAPEv2/storage/analyses/5094/files/186adaab8e481b96bfe8d1774ea655fbb3385c7a5215966e49c3f17367461342 -
186adaab8e481b96bfe8d1774ea655fbb3385c7a5215966e49c3f17367461342 - /opt/CAPEv2/storage/analyses/5094/files/0e10eafe0a40bc64c6ad9a7395b92f6c5eec92d814552de6a1547c3bd177426f -
0e10eafe0a40bc64c6ad9a7395b92f6c5eec92d814552de6a1547c3bd177426f - /opt/CAPEv2/storage/analyses/5094/files/c4a7d179039918797cc5479d6a6516a0b91277def3be57c84dbec3007ba76394 -
c4a7d179039918797cc5479d6a6516a0b91277def3be57c84dbec3007ba76394 - /opt/CAPEv2/storage/analyses/5094/files/eedb9d98a5438fe83c9d3a9731ec37e6f2331e419a28506532db9c48e04dfa9c -
eedb9d98a5438fe83c9d3a9731ec37e6f2331e419a28506532db9c48e04dfa9c - /opt/CAPEv2/storage/analyses/5094/files/c952718bbecb9506a2ac3069f32b7ed399701f6a279788e001bc14876d4a9ee3 -
c952718bbecb9506a2ac3069f32b7ed399701f6a279788e001bc14876d4a9ee3 - /opt/CAPEv2/storage/analyses/5094/files/e0c0a5a360482b5c5ded8fad5706c4c66f215f527851ad87b31380ef6060696e -
e0c0a5a360482b5c5ded8fad5706c4c66f215f527851ad87b31380ef6060696e - /opt/CAPEv2/storage/analyses/5094/files/bdb6aa08ee83e393fdf805e682eb06adf4fe03dc62bbcaeebcf8973811b8647b -
bdb6aa08ee83e393fdf805e682eb06adf4fe03dc62bbcaeebcf8973811b8647b - /opt/CAPEv2/storage/analyses/5094/files/bbca9c85311c7f303deece4ed0c3e047b6f9f254cd87fa2d4a077bbc6d4ecb86 -
bbca9c85311c7f303deece4ed0c3e047b6f9f254cd87fa2d4a077bbc6d4ecb86 - 33bbab14ab76bb1dd814e024531bd0ebfd3c1c346e9d8e41b601e31663d57a71 -
33bbab14ab76bb1dd814e024531bd0ebfd3c1c346e9d8e41b601e31663d57a71 - d68f322d35f09bcf6abc1635178b5baff28f204bc9d9f8071cc8414fa91954e5 -
d68f322d35f09bcf6abc1635178b5baff28f204bc9d9f8071cc8414fa91954e5 - 78cd254034f0aadfafa29e0fa89e05097b2896067c899cafca7165f17f472a27 -
78cd254034f0aadfafa29e0fa89e05097b2896067c899cafca7165f17f472a27 - 9ec47c696b9936c11dd8abe6bfdd1596aca647a86f0a61df4834c6b6226fb994 -
9ec47c696b9936c11dd8abe6bfdd1596aca647a86f0a61df4834c6b6226fb994 - 3776da28a41ef0c2c1085588229e8df1e2b3e831ac57a618fab15f7cc9d214ba -
3776da28a41ef0c2c1085588229e8df1e2b3e831ac57a618fab15f7cc9d214ba
Embedded URLs
- http://nsis.sf.net/NSIS_Error
Embedded domains
- nsis.sf.net
- linetechservice.org
- serviceonline2013.org
- servicewebcheck.org
- aefd.nelreports.net
Embedded IP addresses
- 95.211.9.145
More VBInject samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report