MALICIOUS — Счет на оплату № 723.exe

MALICIOUS — Счет на оплату № 723.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (86/100). 3 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 5422cef87fe1063df577be9664a912e97d57b161f87ec92eefa12b79bccb641d
• SHA-1: 99710e5e3ad4c847bd0a955a6995f956e9338325
• MD5: bc7d8a6876b718b5133beab8e386a041
• imphash: f2128c16c98310b27531db0acb10e092
• ssdeep: 24576:AZKzIiPyVfgF0xztTEAhiTKe9SND/KjxNdQZ5yCXa:
• TLSH: T1FD509E32084F415ED6BB3EBB7C48AE1EBBD7E173300B6174648DE61A7E6508B7945088
• Submitted as: Счет на оплату № 723.exe
• File type: pe · Size: 792064 bytes
• Verdict: malicious (86/100)

Detections (3 of 55 engines)

• capa (capabilities): capability:collection/keylog
• Emsisoft (Emergency Kit): Gen:Variant.TDss.69
• Kaspersky (KVRT): UDS:Trojan.Win32.GenericML.xnet

MITRE ATT&CK

• T1486
• T1056.001

Why this verdict

The malicious score of 86/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged Gen:Variant.TDss.69 (rule Gen:Variant.TDss.69) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.Win32.GenericML.xnet (rule UDS:Trojan.Win32.GenericML.xnet) - engine signal, weight 0.55, confidence 0.85
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
• encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report