MALICIOUS — 5a9c4266a9d60b692175c27714fbac2fb68b1b44f58bee458c8509ffaf39c378

MALICIOUS — 5a9c4266a9d60b692175c27714fbac2fb68b1b44f58bee458c8509ffaf39c378 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 5a9c4266a9d60b692175c27714fbac2fb68b1b44f58bee458c8509ffaf39c378
SHA-1: 1e24909cc84220ec46afe05f20cc6180a8ce16e8
MD5: 2c7cc7f20751caeb894c3e150049de5b
imphash: d0c59b9a9b9f2208ab9452466b7f74a6
ssdeep: 3072:uefeft5L7pVDujN/vTI89+6fSAFkRjHTacl5w+432f4Si9yC:85PpFuZ/vTL9+6NkaC5DbC
TLSH: T1BC3F73DE862F7311D6F6D838652089ED400AB488617D7FCD4A03D67640E2E37ECB64A9
Submitted as: 5a9c4266a9d60b692175c27714fbac2fb68b1b44f58bee458c8509ffaf39c378
File type: pe · Size: 163840 bytes
Verdict: malicious (88/100)

Detections (3 of 56 engines)

capa (capabilities): capability:credential-access
LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: flagged

MITRE ATT&CK

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
Contacted 2 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:credential-access (rule capability:credential-access) - engine signal, weight 0.35, confidence 0.70
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

347 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

6a9bffcab7a2fe9590194dc3ef0f7105a1832911ad259f061dc22fd9a27e9769 - 6a9bffcab7a2fe9590194dc3ef0f7105a1832911ad259f061dc22fd9a27e9769

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

crl.microsoft.com
www.microsoft.com

Embedded IP addresses

4.207.44.66
52.123.252.226
4.230.171.124
20.42.179.192
20.247.184.197
135.232.92.97
4.150.223.108
135.232.92.137
40.79.163.155
172.66.2.5
52.110.12.54
52.110.12.10
40.84.85.40
172.178.240.163
52.110.12.45
52.110.12.1

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report