MALICIOUS — 5828fab93de5c8e802a8f1be0989748b1dad5005ddc6a14f6c6afdd791a4750a

MALICIOUS — 5828fab93de5c8e802a8f1be0989748b1dad5005ddc6a14f6c6afdd791a4750a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100). 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 5828fab93de5c8e802a8f1be0989748b1dad5005ddc6a14f6c6afdd791a4750a
SHA-1: a79f8632494d88a8aa1834e63c13ed4d618f6618
MD5: 81bd80bc10a3e0aef45214747c3a4699
imphash: de066f8c4a4ea67da51fe8ae7fa3263d
ssdeep: 1536:SPIP+wRj0IaxamasaXaq4noBU66yVZxrkEhjbb:mI2C0Ob
TLSH: T15344A9E65290F409C982F049051BD6CEAD8CEE90E249D8563D7D2B4F36D1707EC68AEC
Submitted as: 5828fab93de5c8e802a8f1be0989748b1dad5005ddc6a14f6c6afdd791a4750a
File type: pe · Size: 253952 bytes
Verdict: malicious (100/100)

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.VB-1321
Microsoft Defender: Worm:Win32/Vobfus!pz
Emsisoft (Emergency Kit): Gen:Variant.Doris.7309
Trellix Stinger (McAfee): Downloader-CJX.gen.au
Kaspersky (KVRT): Worm.Win32.WBNA.ipa

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Trojan.VB-1321 (rule Win.Trojan.VB-1321) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Worm:Win32/Vobfus!pz (rule Worm:Win32/Vobfus!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Doris.7309 (rule Gen:Variant.Doris.7309) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Downloader-CJX.gen.au (rule Downloader-CJX.gen.au) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.WBNA.ipa (rule Worm.Win32.WBNA.ipa) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

47229 behavior events · 3 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\duouf.exe - 41c5db37c80de58adf3294329179c4e5f30ddb0bba9a98c80bd53021597498ca
4511c066bbeb0a73e4049a159e52c1f23d308dbdf59f5d46f0bdc3b60ef504ec - 4511c066bbeb0a73e4049a159e52c1f23d308dbdf59f5d46f0bdc3b60ef504ec
75c719963d0b92359964097e4747c9f727a667f1641c845c7fb9c60312783d28 - 75c719963d0b92359964097e4747c9f727a667f1641c845c7fb9c60312783d28
f601060da6c561b9e142330b19786c3599532f7ffac8844967e1ff8b69676025 - f601060da6c561b9e142330b19786c3599532f7ffac8844967e1ff8b69676025
5e8c3dd1f77e29413a1b16068174c5798a250b06c3c3e65d35beeffb703acca5 - 5e8c3dd1f77e29413a1b16068174c5798a250b06c3c3e65d35beeffb703acca5

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

ns1.player1253.com
ns1.videoall.net
ns1.mediashares.org

Embedded IP addresses

4.150.223.115
52.230.60.54
57.155.101.212
4.230.171.124
74.178.240.51
20.42.65.84
20.165.94.63
172.66.2.5
52.110.12.11
52.110.12.18
52.182.143.212
51.116.246.106
135.233.45.222
72.154.7.114
52.148.114.188
52.110.12.21
52.110.12.2

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report