MALICIOUS — 57dfaa2d88cb52382bfcd4964403e2c78670c4998668f2a8a457c75ae7dd622d

MALICIOUS — 57dfaa2d88cb52382bfcd4964403e2c78670c4998668f2a8a457c75ae7dd622d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Crypted family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 57dfaa2d88cb52382bfcd4964403e2c78670c4998668f2a8a457c75ae7dd622d
SHA-1: c3b34c1c9f9b2253c301ca0f11c1b0e207b55a0f
MD5: 37b5163c99c7e44eabb398efa5254865
imphash: 95e6f8741083e0c7d9a63d45e2472360
ssdeep: 3072:exvH9DZHTSmFHucu/FcaMYnn8rPVJT4zHQoBbmh39IVabUu/FcaMYnn8rPVJT4z:epdDZHh1ut18rPD4TJBUe0118rPD4T
TLSH: T15D41D2563340B762EAAA9229222CB1FDD532D6F26C254381C3DB5101BEF5CDBED4D818
Submitted as: 57dfaa2d88cb52382bfcd4964403e2c78670c4998668f2a8a457c75ae7dd622d
File type: pe · Size: 196608 bytes
Verdict: malicious (99/100) · Family: Crypted

Detections (4 of 56 engines)

ClamAV (daily): Win.Trojan.Crypted-31
Microsoft Defender: TrojanDownloader:Win32/Berbew!pz
Emsisoft (Emergency Kit): GenPack:Backdoor.Hangup.B
Kaspersky (KVRT): Trojan-Spy.Win32.Qukart.af

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Trojan.Crypted-31 (rule Win.Trojan.Crypted-31) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged TrojanDownloader:Win32/Berbew!pz (rule TrojanDownloader:Win32/Berbew!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged GenPack:Backdoor.Hangup.B (rule GenPack:Backdoor.Hangup.B) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Spy.Win32.Qukart.af (rule Trojan-Spy.Win32.Qukart.af) - engine signal, weight 0.55, confidence 0.85
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

104 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Windows\System32\Hnfnof32.exe - 73d2f63c1dd45e267aadfd2f735b8722875a4101654f1c1b4dfb75b05abb969f
C:\Windows\System32\Bbomlf32.dll - 7e2557289c5a0671e2cdd49248f497eea0db3a5dee6e8691175d19b3b2cf0288

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

51.132.193.105
4.230.171.124
172.215.188.225
104.18.33.89
74.178.76.54
52.230.59.222
4.150.223.96
74.179.77.204
104.208.16.94
20.184.175.15
20.42.73.28
135.233.45.223
52.110.12.37
52.110.12.50

More Crypted samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report