MALICIOUS — 591e3e9b7f448a3eb74446519919ffff7c0d5c31e530cc5d5fcf6936685ad834

MALICIOUS — 591e3e9b7f448a3eb74446519919ffff7c0d5c31e530cc5d5fcf6936685ad834 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the Copak family. 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 591e3e9b7f448a3eb74446519919ffff7c0d5c31e530cc5d5fcf6936685ad834
• SHA-1: 947cb869ed86f6c3eff6037b850daf4123fbe030
• MD5: 461bbdf045d8576de1c899339090d640
• imphash: 9dd4f066232cb6eb38c84b098cd6f457
• ssdeep: 49152:BLzsMYzoC8Fd0M1rLwan7SQo5pPc6eAocWX6ngkgRQ2:BLzsHcB3rhn7SQo5pPHhi+LOQ
• TLSH: T1BE5C33543A7E2A08DBB1C0020A61A0DFAD861D0DB1B66815744FE365D870FE379E3BC9
• Submitted as: 591e3e9b7f448a3eb74446519919ffff7c0d5c31e530cc5d5fcf6936685ad834
• File type: pe · Size: 2409984 bytes
• Verdict: malicious (94/100) · Family: Copak

Detections (4 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• Microsoft Defender: Trojan:Win32/Injector.RAQ!MTB
• Emsisoft (Emergency Kit): Gen:Variant.Lazy.327786
• Kaspersky (KVRT): UDS:Trojan.Win32.Copak

MITRE ATT&CK

• T1105

Why this verdict

The malicious score of 94/100 is the fusion of 8 weighted signals:

• Microsoft Defender flagged Trojan:Win32/Injector.RAQ!MTB (rule Trojan:Win32/Injector.RAQ!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Lazy.327786 (rule Gen:Variant.Lazy.327786) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.Win32.Copak (rule UDS:Trojan.Win32.Copak) - engine signal, weight 0.55, confidence 0.85
• Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
• Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
• Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 6036) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

332 behavior events · 0 ATT&CK techniques · 6 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• update.googleapis.com
• desktop-hsgcbep
• login.live.com
• v20.events.data.microsoft.com
• licensing.mp.microsoft.com
• config.edge.skype.com
• windows.msn.com
• officeclient.microsoft.com
• www.msn.com
• odc.officeapps.live.com
• assets.msn.com
• www.bing.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• www.msftconnecttest.com/connecttest.txt

Dropped files

• C:\Users\analyst\AppData\Local\Temp\tsk_6d8e644169af4716.exe - 820e20914a31751d3242377416cb0ec74f3799a5bcda90777110ce6f75e68ec9
• 71ec7c96da00b595489ae25971869a56c991880d212e2c4f534e532e048f6942 - 71ec7c96da00b595489ae25971869a56c991880d212e2c4f534e532e048f6942
• 48d947b14ab41c9b75f258ab8be6c0ee778bc85ecad0b6a723d06ca57210d198 - 48d947b14ab41c9b75f258ab8be6c0ee778bc85ecad0b6a723d06ca57210d198
• dfb2343e66de5b20619e59f92755174d9ad6b656affdbdf3fa65aa5cc46f05a1 - dfb2343e66de5b20619e59f92755174d9ad6b656affdbdf3fa65aa5cc46f05a1
• ff0f070ead4fe2feea331fd3b82f57e771960f2d6417e3094c4673c8cb00a3c8 - ff0f070ead4fe2feea331fd3b82f57e771960f2d6417e3094c4673c8cb00a3c8
• 2252872955020d53a56a270bda711a79e43c026d5c5c4efc14b42d7bb7ff1156 - 2252872955020d53a56a270bda711a79e43c026d5c5c4efc14b42d7bb7ff1156

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded IP addresses

• 4.150.223.107
• 4.144.132.114
• 4.230.171.124
• 52.110.12.3
• 52.110.12.26

More Copak samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report