MALICIOUS — 51cd8bee755538b484c4dde790c25abf0e3f3ad4e0358831df20f98a0b42e382

MALICIOUS — 51cd8bee755538b484c4dde790c25abf0e3f3ad4e0358831df20f98a0b42e382 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 51cd8bee755538b484c4dde790c25abf0e3f3ad4e0358831df20f98a0b42e382
SHA-1: 62ef1052afd9b99e54359ea87f3240a46c825745
MD5: 7ffcb234ca1900bcc57778ad1c6d0249
imphash: 7ecd8f76627cb5379a7c0b0c02b48c9c
ssdeep: 24576:6ZYsYJNWlgauWVSuShZW/S7zONx0zqZ4f5/4/31K4COc3YqXh:+cJMggSuSrW/SscAy4E4Cn3tXh
TLSH: T15555238AC5F29E01FE1F27050B098DED162AF8A2C7407A1EA7449E4014D52BF7C9B977
Submitted as: 51cd8bee755538b484c4dde790c25abf0e3f3ad4e0358831df20f98a0b42e382
File type: pe · Size: 1293822 bytes
Verdict: malicious (99/100)

Detections (4 of 56 engines)

ClamAV (daily): Win.Downloader.20341-1
Microsoft Defender: TrojanDownloader:Win32/Loan.BG!MTB
Emsisoft (Emergency Kit): Gen:Trojan.Heur.orZ@H9kNqkgb
Kaspersky (KVRT): Trojan-Downloader.Win32.Loan.a

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Downloader.20341-1 (rule Win.Downloader.20341-1) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged TrojanDownloader:Win32/Loan.BG!MTB (rule TrojanDownloader:Win32/Loan.BG!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Trojan.Heur.orZ@H9kNqkgb (rule Gen:Trojan.Heur.orZ@H9kNqkgb) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Downloader.Win32.Loan.a (rule Trojan-Downloader.Win32.Loan.a) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

10092 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Windows\System32\sal.exe - 70370da5a1bf19d37aa902221af7df63f209cfc78ffbe1e9283b72111e81bcee

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.65.84
52.253.84.76
52.123.252.236
4.230.171.124
172.66.2.5
85.210.193.152
135.234.160.245
184.84.165.171
184.84.165.136
40.84.97.4
52.110.12.53
52.110.12.21
72.154.7.106
52.148.114.188

File paths

e:\home\sample.exe
c:\qc4xsz.exe
c:\pxemwm.exe
c:\dbmjtn.exe
c:\efr3bv.exe
c:\05d93bffaf0d7a0ecc3b401979037332839cbf8e3e3fc91ad65ea2d6682d0575C
c:\bab3fdb7ef1c4bf9f6b8ec35e6b0620ad9152a8e2044dd4666580cca07d1354cC
c:\79fbe6af6e810584c8bbebbd0ada3c4da99e4e23fd3e142a5aff75b594aa0c4bC
c:\vdkabraa.exe
c:\users\george\desktop\program.exe#
c:\6c4c98839c0e26ea05dcc8fcd78b68e18b0105be848367e750f5e6a40ebd379aC
c:\users\r.vult\appdata\local\temp\7714d64a6c7ffd8af64ddfe9f87de8eb.exeG
c:\e6a7d70b02767e9624b444fed680e8d663e93ee33db29bd47d0064cea5b7e6beC
c:\e3daa25c9490e375efea6d1d7b67da8bf3a466a3cc8282d4a8c1c27e7ee3dc4aC
c:\documents
c:\users\maxine\appdata\local\temp\file.exe+
c:\glk4e_ao.exe
c:\azalnnfl.exe
c:\users\george\desktop\software.exe$
c:\b75ddc38fe70be136148755d71688a486b1f45afd0bb6fabd573436775af8f81C
c:\3b4a9104dab22dcdbf75a974dbfb53c3b3e919afb794caf196710570d73417fdC
c:\44c423887f60a4ddb5da84b21eff121d54d13d1c94d0c9986853fb9f49443955C
c:\c9f9915e452056ff381fc6bbc33bd6f21a2300781c21ea02289e40c9b4aeae19C
c:\users\george\desktop\sal.exe
c:\2c5da859a7bff9d7c7c229adbc1a391175cb6d772d584a3f5831b9a1fecbf76fC

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report