MALICIOUS — 5526cdfe9384d63ab4beb181703f909c440cd29b13bc2916a43c6513eb312f25

MALICIOUS — 5526cdfe9384d63ab4beb181703f909c440cd29b13bc2916a43c6513eb312f25 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Fileinfector family. 5 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 5526cdfe9384d63ab4beb181703f909c440cd29b13bc2916a43c6513eb312f25
SHA-1: c702d9c832e33b3c559d67ff7ccd7095049f5b37
MD5: 5c8cfe2b4684687ada758c3eecd62710
imphash: 895fbb56c02c3d2bca3125cef5da8730
ssdeep: 24576:VFZcGeDdF364C12SDnnrM+2rOzFabDA0HvkUYIVYZeVwfQkrKJFWxDrpsQTSarpK:KNK4Af4
TLSH: T1BD60E846643A81CCF5DCCBB9657CEC5C97B432F6EE6809079885A8258289DDFC9C36C0
Submitted as: 5526cdfe9384d63ab4beb181703f909c440cd29b13bc2916a43c6513eb312f25
File type: pe · Size: 3670016 bytes
Verdict: malicious (99/100) · Family: Fileinfector

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Fileinfector-9832954-0
Detect It Easy (packer/type): DIE:MinGW
Microsoft Defender: Trojan:Win32/Vindor!pz
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Fileinfector-9832954-0 (rule Win.Malware.Fileinfector-9832954-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Terminates Browser, Office or Security Processes [medium] (rule tl-process-kill) - dynamic signal, weight 0.40, confidence 0.90
Contacted 59 external host(s) at runtime (31 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MinGW (rule DIE:MinGW) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, MinGW - static signal, weight 0.25, confidence 0.55
Dropped 15 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

41091 behavior events · 2 ATT&CK techniques · 28 dropped files.

Dropped files

C:\Windows\System32\PrintConfig.dll - d1b2bc7705f241799431ed0f020f27eb32fab0d81d5b00137710335227de5b3f
C:\Windows\System32\msvcp140_codecvt_ids.dll - 879971eb65473e8b933b863076f62a9d3c0e8d8272bc718ebf2b2b0c993fcdef
C:\Windows\System32\msclmd.dll - 28218b240405a176007843098811fe69ecff2025fcbd5eff322a0f6901d746b0
C:\Windows\System32\msvcp140_atomic_wait.dll - b3672a60e314dde07d8d9fc130f194d524a88e070c795174ce0d5d719492e7cc
C:\exc.exe - 7261c2065d0ad5fd67aca8a5f9f60f2ba6a927789ed8d418ac0d4b8dc76c1bdb
C:\Windows\DtcInstall.log - f000ed3bc0e0e8200c129815989285bcfd12239761c36dc7d16a781e798e5027
C:\Windows\SysmonDrv.sys - 0a0a9c2263e478956281ae38995294564d27bf7f7bc240782961a90ceea68cf1
C:\Windows\System32\msvcp140_2.dll - 8691acc1a3977e03c73fc3068cd9e149e2cdeb7a069c2380fbd5cb233169600a
C:\Windows\setuperr.log - e55fcbf4569bc91339abebabbeb16c8d0b071e84df8eb6619594c90bd5dc2e45
C:\Windows\System32\dssec.dat - c331fc5ffe65e61e6626440f8041fc30821cce4afa84c227de5de1aa935228e7
C:\Windows\System32\vccorlib140.dll - 9aa66b0f19bea60a38a2e8cafd9a3310343a6d8bd0ff7396a5044c6188bfd341
C:\Windows\setupact.log - a8ce0f307b54589d349dd7c04e8e9c3eac009de2d1afcd4d27645517f35e4965
C:\Windows\System32\concrt140.dll - 978c8769caa4ab943e42b67d1c914c11a310e41238868466ef25ca7b730c6f5c
C:\Windows\System32\license.rtf - 028422501901784dd66347e15905d29201bc0822ba2491bf89df2169ec941ace
C:\Windows\System32\NOISE.DAT - 233a970c49c0e12ee283c2a91ea60a14683fd1eb091d529ecbc26ad0ac579cf3

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787841055&P2=404&P3=2&P4=YAh5G26oCnsrOtedgJAojerQqRm2frHLYR2BH8YD3Brwu99%2bsl4I2eGpUPGRMgLTChHeZmXqzpaMyZgk4mVIkA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787841119&P2=404&P3=2&P4=eyVsMI4OUkYSH59ubOza6UwlSuRanqm%2bMabR8C%2fL7A4iI5eEsHsfY8q8Azv7YQTDWIeWlDrGAOUxUZAE%2bJs%2b8g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://www.freeav.com/

Embedded domains

aefd.nelreports.net
www.freeav.com
www.avira.com
script.crazyegg.com
nexus.ensighten.com
assets.adobedtm.com
t.nc0.co
doh.cq0.co
www.webassetscdn.com
s.go-mpulse.net
widget.trustpilot.com
data.privacy.ensighten.com
dpm.demdex.net
symantec.demdex.net
symantec.tt.omtrdc.net
rmbyy5ra.avira.com
www.nortonlifelock.com
mhubc.avira.com
oms.avira.com
getrockerbox.com
www.antispyware.com
img6.wsimg.com
img1.wsimg.com
edge.fullstory.com
rs.fullstory.com

Embedded IP addresses

4.150.223.102
52.123.252.212
52.123.252.219
4.230.171.124
4.247.188.233
52.230.59.222
48.211.4.16
52.123.252.223
135.233.95.80
74.178.240.61
4.150.223.112
74.178.240.51
203.26.79.13
20.231.239.246
52.123.129.14
52.123.128.14
20.50.73.15
135.233.45.222
52.168.117.170
52.148.114.188
72.154.7.107
52.58.28.12
20.11.121.11
4.195.116.8
92.223.78.30

More Fileinfector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report