MALICIOUS — 546b7794a143529f0768fc62741e84922f548a3abe44c97a69a9463bebd9b3f7

MALICIOUS — 546b7794a143529f0768fc62741e84922f548a3abe44c97a69a9463bebd9b3f7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Msilkrypt family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 546b7794a143529f0768fc62741e84922f548a3abe44c97a69a9463bebd9b3f7
SHA-1: bb7a47c7faa11f778a2b520594bf486b8d1339c9
MD5: 9180b44af787beb7fe01da22bc416775
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 192:CBksuDEXVwViseMZZ3193VnjdwCzq3ORw08:OVwUseMnFnhwCmg
TLSH: T133221ADF1A584E83CB7ED51B5141CA7EB480749E68B3229C12048B335439833A97E7EB
Submitted as: 546b7794a143529f0768fc62741e84922f548a3abe44c97a69a9463bebd9b3f7
File type: pe · Size: 9728 bytes
Verdict: malicious (100/100) · Family: Msilkrypt

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Msilkrypt-9839010-0
Microsoft Defender: PWS:MSIL/Infostealer.PAC!MTB
Emsisoft (Emergency Kit): Gen:Trojan.Mardom.PN.16
Kaspersky (KVRT): HEUR:Trojan.MSIL.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Msilkrypt-9839010-0 (rule Win.Malware.Msilkrypt-9839010-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged PWS:MSIL/Infostealer.PAC!MTB (rule PWS:MSIL/Infostealer.PAC!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Trojan.Mardom.PN.16 (rule Gen:Trojan.Mardom.PN.16) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.MSIL.Agent.gen (rule HEUR:Trojan.MSIL.Agent.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
Extracted RedLine config (0 C2) - engine signal, weight 0.45, confidence 0.60
Embedded network infrastructure: http://tempuri.org/IUserService/GetUsersT, http://194.87.145.184:6484/UserService, 194.87.145.184 - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

4057 behavior events · 2 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://tempuri.org/IUserService/GetUsersT
http://194.87.145.184:6484/UserService
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788037545&P2=404&P3=2&P4=iLuGraEZc2Z%2f2NdZNA2yIizmkcobe26HQeEEf%2fnAhXbSeX%2fNnTG9kiA%2fYjlIJA2erao3eCWT9%2fL9jNi4twJVww%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.datacontract.org
tempuri.org

Embedded IP addresses

194.87.145.184
13.69.109.131
52.123.252.230
52.230.60.54
4.230.171.124
74.178.240.51
20.42.73.25
57.154.63.210
135.232.92.137
52.123.252.219
135.233.95.80
203.26.79.13
52.123.252.218
135.234.160.244
52.110.12.20
52.110.12.45
72.154.7.108
92.223.78.30

More Msilkrypt samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report