MALICIOUS — FannyWorm_002F5E401F705FE91F44263E49D6C216

MALICIOUS — FannyWorm_002F5E401F705FE91F44263E49D6C216 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the EquationDrug family. 7 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 54a0c42a920a1080f6478054d0a73296c14e22096bcf901177ef0d28baa1728e
SHA-1: 90dad7e643b866e852e76837c5dccdbbdbf0b09a
MD5: 002f5e401f705fe91f44263e49d6c216
imphash: 6c22181c4a122990e7c1d1ef45848e30
ssdeep: 3072:TtnUNALmVZvvGBeQYejpjIAq2tz2TBfki43y97FozS4Oq1sqH73oGC:p4LvkwejpNquz2TB8i4i0zLOosqHkG
TLSH: T12E419D178330A544D2E6EB717482BC0CD167F5CDB2B2BADB40E582BC6EE44277425A17
Submitted as: FannyWorm_002F5E401F705FE91F44263E49D6C216
File type: pe · Size: 184320 bytes
Verdict: malicious (99/100) · Family: EquationDrug

Detections (7 of 52 engines)

ClamAV (daily): {MD5}bin.trojan.alhw.7561.UNOFFICIAL
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Kaspersky (KVRT): Trojan.Win32.EquationDrug.n
Microsoft Defender: TrojanDownloader:Win32/Eqtonapt.A!dha
Emsisoft (Emergency Kit): Trojan.Dropper.SRY
Trellix Stinger (McAfee): Trojan-FFTB!002F5E401F70

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged {MD5}bin.trojan.alhw.7561.UNOFFICIAL (rule {MD5}bin.trojan.alhw.7561.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Eqtonapt): 787419d07f4bda9bc91072bb8644ed943089ad44f4bb5920bfe452dc111c244d - dynamic signal, weight 0.80, confidence 0.90
Contacted 60 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

165 behavior events · 1 ATT&CK techniques · 3 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/20662/files/787419d07f4bda9bc91072bb8644ed943089ad44f4bb5920bfe452dc111c244d - 787419d07f4bda9bc91072bb8644ed943089ad44f4bb5920bfe452dc111c244d
/opt/CAPEv2/storage/analyses/20662/files/6eb00b34d1daffa49b2f4c90841705b2c994563bde672bf35eb1c46cdb19a1ed - 6eb00b34d1daffa49b2f4c90841705b2c994563bde672bf35eb1c46cdb19a1ed
/opt/CAPEv2/storage/analyses/20662/files/c69a9157638e69fb692d827383c3f27e586e0c98989cffdf8bd4c982ad837a4c - c69a9157638e69fb692d827383c3f27e586e0c98989cffdf8bd4c982ad837a4c

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e?P1=1786781211&P2=404&P3=2&P4=csS7LPuJbfAOBjUz2XfB8NyIc%2fY64z2s9PBXpJl2RYydq%2b51kaMxO9P9McOGJIwg8uikict74WvK9lAlBtO8xg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.184.175.15
52.123.252.222
57.154.63.210
4.230.171.124
20.247.184.142
74.178.240.61
20.42.73.26
149.154.167.99
172.178.240.163
52.123.252.224
20.42.73.27
52.123.128.14
52.123.252.219
52.123.252.220
4.150.223.106
85.210.196.11
52.123.252.227
40.99.133.210
20.165.94.54
162.159.142.9
20.112.250.133
52.123.129.14
74.178.76.54
162.159.36.2
4.150.223.103

File paths

c:\windows\system32\kernel32.dll
d:\fanny.bmp
x:\fanny.bmp
Q:\__

More EquationDrug samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report