MALICIOUS — 57fe67a22a2ff9e67eb96a10c27f8b84ff1c0e9b2fba587a81f53bd6abe59337

MALICIOUS — 57fe67a22a2ff9e67eb96a10c27f8b84ff1c0e9b2fba587a81f53bd6abe59337 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Vobfus family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 57fe67a22a2ff9e67eb96a10c27f8b84ff1c0e9b2fba587a81f53bd6abe59337
SHA-1: 2faccfc4e4d8861ad28c4bf9e06dae842afcb4a6
MD5: be482bfbdefa1204ab32cc3109738cf0
imphash: b4b1c862d51caba1f883b632ab00c110
ssdeep: 1536:ObxwV7vst+SbtS0SIImNMlsCSZxIG+UkHosoFNDN:JvzRflos+N
TLSH: T1DF35B6581679D4A1F2B5E71F4EC99D7C0BCE8505A63A18A1218E9F0F1CD35F3A03862E
Submitted as: 57fe67a22a2ff9e67eb96a10c27f8b84ff1c0e9b2fba587a81f53bd6abe59337
File type: pe · Size: 61440 bytes
Verdict: malicious (100/100) · Family: Vobfus

Detections (5 of 56 engines)

ClamAV (daily): Win.Malware.Vobfus-9806879-0
Microsoft Defender: TrojanDownloader:Win32/Purora
Emsisoft (Emergency Kit): Gen:Variant.Chinky.2
Trellix Stinger (McAfee): Downloader-CJX.gen.l
Kaspersky (KVRT): Worm.Win32.VBNA.brlr

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Vobfus-9806879-0 (rule Win.Malware.Vobfus-9806879-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged TrojanDownloader:Win32/Purora (rule TrojanDownloader:Win32/Purora) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Chinky.2 (rule Gen:Variant.Chinky.2) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Downloader-CJX.gen.l (rule Downloader-CJX.gen.l) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.VBNA.brlr (rule Worm.Win32.VBNA.brlr) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

47054 behavior events · 3 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\feaxue.exe - 0a363c0952e634b87082729ad77a69c7c1249eabcb2cb221dd0f8c23a11aa482
85d5b853519585528bd9feb5d50d7d4f1c15a5a282989ad65fd1f4e61d2061a2 - 85d5b853519585528bd9feb5d50d7d4f1c15a5a282989ad65fd1f4e61d2061a2
801e16eaa73426c0bb16ec13338ef39fc98d4b1236e39ddfef735a2f2e8d2a61 - 801e16eaa73426c0bb16ec13338ef39fc98d4b1236e39ddfef735a2f2e8d2a61
3d8e06c4685f32bb70fd4b0c695a8f02d6164c0f2508a2c110eb57d7083fd93b - 3d8e06c4685f32bb70fd4b0c695a8f02d6164c0f2508a2c110eb57d7083fd93b
c8fda18312d0058a93067b3daad6ef6223c653abe012eb0ff57b094b43d56ea4 - c8fda18312d0058a93067b3daad6ef6223c653abe012eb0ff57b094b43d56ea4

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

ns1.player1253.com
ns1.videoall.net
ns1.mediashares.org

Embedded IP addresses

20.247.184.142
20.42.73.27
4.230.171.124
52.230.60.54
20.184.175.17
20.184.175.4
172.178.240.162
40.84.97.4
85.210.193.152
52.110.12.52
52.110.12.10
72.154.7.112
52.148.114.188
52.110.12.1
52.110.12.33

File paths

E:\Program

More Vobfus samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report