MALICIOUS — 5ad664ee2b91614eedc60ab3386b3bc70c87f26f94250f1ad2394c22ec28a04c

MALICIOUS — 5ad664ee2b91614eedc60ab3386b3bc70c87f26f94250f1ad2394c22ec28a04c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Container family. 6 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 5ad664ee2b91614eedc60ab3386b3bc70c87f26f94250f1ad2394c22ec28a04c
SHA-1: c9a5bdbd7aaa618e65fe3e7acaddd0c60fd5e60a
MD5: d212e5dcb3ea03ccd7bd55390c43cf4f
imphash: eb668c19a5999b948d7fef423895f0a5
ssdeep: 49152:tUFS5SUH/JHrFblqBbokC3HX0NqaPBQM2Ig9vxqtJT6yIp+Sz+OIAS/4fg830iWR:yopUbEHpaPhgxpF3r7m
TLSH: T1C4645B5B012B2225D6EAEF00703084EED063F5E4B5341D9B8587DA1640D9E2FBFA53E9
Submitted as: 5ad664ee2b91614eedc60ab3386b3bc70c87f26f94250f1ad2394c22ec28a04c
File type: pe · Size: 5476464 bytes
Verdict: malicious (100/100) · Family: Container

Detections (6 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
capa (capabilities): capability:collection/keylog
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: ESET research: coruscant
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 17 weighted signals:

Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in tsk_012c48e691 (pid 3472) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
YARA: ESET research flagged coruscant (rule coruscant) - engine signal, weight 0.70, confidence 0.70
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.55, confidence 0.70
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: https://onestart.ai/uninstallsurvey, https://event.onestartapi.com, https://onestartapi.com/api/bb/updates.txt - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 4 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

93 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

https://onestart.ai/uninstallsurvey
https://event.onestartapi.com
https://onestartapi.com/api/bb/updates.txt
https://onestartapi.com/chr/gcsett?iid=
https://onestartapi.com/chr/uninstall?iid=
https://crashpad.chromium.org/
https://crashpad.chromium.org/bug/new
http://www.w3.org/2001/XMLSchema-instance
https://curl.haxx.se/docs/http-cookies.html
http://www.digicert.com/CPS0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

openssl.org
onestart.ai
uninstall.cc
mutex.cc
field.cc
time.cc
event.onestartapi.com
onestartapi.com
crashpad.chromium.org
install.cc
www.w3.org
blink.net
values.cc
logging.cc
arena.cc
thunks.cc
mem.cc
settings.cc
shortcut.cc
curl.haxx.se
example.com
thread.cc
sequence.cc
cacerts.digicert.com
crl3.digicert.com

Embedded IP addresses

1.101.3.4
52.168.117.169
52.253.84.76
4.230.171.124
4.247.188.233
40.79.163.155
74.178.240.51
74.178.240.61
162.159.142.9
34.104.35.123
48.199.12.1
20.42.65.90
104.18.33.89
203.26.79.13
52.148.114.188
72.145.35.104
52.110.12.55
52.110.12.16

File paths

C:\Program
C:\Windows\System32\cmd.exe

More Container samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report