MALICIOUS — 5395ef7901731de4f83aaacf2757416a1830aa608ee38d70d4da8caf466fbff6.exe

MALICIOUS — 5395ef7901731de4f83aaacf2757416a1830aa608ee38d70d4da8caf466fbff6.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prometei family. 11 of 53 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 5395ef7901731de4f83aaacf2757416a1830aa608ee38d70d4da8caf466fbff6
SHA-1: f9ec500cc050101e0e2f45f94e6906edd9fb8d2b
MD5: 3549f1fba922f40330aaa081ce71fed2
imphash: 83159e0f0a0d21de120cca681467b360
ssdeep: 6144:fRzeTJQJfChxxTnECpq9XkCnNNCoo/iSq9opz5Pv5Pi12dwy9:fJZJfChLjE4q9X7HGqZ9opzvi1y9
TLSH: T19547D057A00E1646FFB823189E011E2FD090E91454BE944B0F535EDBA1C66AFDE20BB7
Submitted as: 5395ef7901731de4f83aaacf2757416a1830aa608ee38d70d4da8caf466fbff6.exe
File type: pe · Size: 342004 bytes
Verdict: malicious (100/100) · Family: Prometei

Detections (11 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Trojan.Prometei-8977166-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
YARA: Yara-Rules community: YR_AntiDebug_Checks
Hash: abuse.ch ThreatFox: known-malicious-hash
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Prometei.CCIR!MTB
Emsisoft (Emergency Kit): Gen:Heur.Variadic.Prometei.A
Kaspersky (KVRT): HEUR:Backdoor.Win32.Prometei.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 17 weighted signals:

ClamAV (daily) flagged Win.Trojan.Prometei-8977166-0 (rule Win.Trojan.Prometei-8977166-0) - engine signal, weight 0.90, confidence 0.95
Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Prometei.CCIR!MTB (rule Trojan:Win32/Prometei.CCIR!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Variadic.Prometei.A (rule Gen:Heur.Variadic.Prometei.A) - engine signal, weight 0.55, confidence 0.85
Contacted 40 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
Extracted Prometei config (0 C2) - engine signal, weight 0.45, confidence 0.60
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://152.36.128.18/cgi-bin/p.cgi, http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.zero/cgi-bin/prometei.cgi, https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text, Microsoft Linker - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60

Dynamic analysis (windows)

5076 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/4677/files/3a7986b4bb20f7e2f5aad8ed44cb4a954e2b359a05376ac7bd74fd260930a2d6 - 3a7986b4bb20f7e2f5aad8ed44cb4a954e2b359a05376ac7bd74fd260930a2d6
0e064410e97754fc8e0551ab0f1cbca25f551384c7bdf247ea9e93d3450c21d1 - 0e064410e97754fc8e0551ab0f1cbca25f551384c7bdf247ea9e93d3450c21d1

Embedded URLs

http://152.36.128.18/cgi-bin/p.cgi
http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.zero/cgi-bin/prometei.cgi
https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/92621512-d997-4742-9ae0-db0593ed93c6/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/92621512-d997-4742-9ae0-db0593ed93c6?P1=1785962097&P2=404&P3=2&P4=R9oII0gGVGJiYLXRky5dvC59uYZYVaXsOlY7hd%2fO6ogY7NJ9iQwKlvgGm2douyfThCz660K10vFRgPHz%2f9OIQw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.zero
gb7ni5rgeexdcncj.onion
staging.to-do.officeppe.com
oneclient.sfx.ms

Embedded IP addresses

8.8.8.8
152.36.128.18
172.16.88.23
172.16.88.35
172.16.88.37
10.0.204.2
23.221.133.185
150.171.22.17
4.150.223.99
52.110.12.21
52.110.12.53
52.168.117.174
172.215.188.232
20.236.44.162
52.98.142.242
52.123.129.14
52.98.142.146
52.98.143.210
204.79.197.203
23.11.36.157
23.40.52.209
23.33.238.102
40.84.85.40
74.179.77.204
74.178.240.51

Registry keys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UPlugPlay
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

File paths

C:\Windows\
C:\Windows\svchost.exe
C:\windows
C:\windows\

More Prometei samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report