MALICIOUS — 5bc96c033507702a4f23e9e05da526b3f08ad261b9ca1e60688975d12177eeb6

MALICIOUS — 5bc96c033507702a4f23e9e05da526b3f08ad261b9ca1e60688975d12177eeb6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Crypted family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 5bc96c033507702a4f23e9e05da526b3f08ad261b9ca1e60688975d12177eeb6
SHA-1: b28efbdc090135d1aa8e8ec7fb610005e03d5def
MD5: 5a338afeeee53e86d1b5a18f7a69b236
imphash: 62ec3dce1eba1b68f6a4511bb09f8c2c
ssdeep: 768:cS01aaetD1h6fI5PzqVMfqCa3czxNAdbmyXz5kfIoyuuZ8UtgJn2p/1H5kJXdnh:cS0+3wf+rOMha3yxNAdiyXSwrqn2Lur
TLSH: T12F346D2FCD1CAB1DEC98CA5D1504B85D87D520E73BA20261A85360DB417A0A7AFC73ED
Submitted as: 5bc96c033507702a4f23e9e05da526b3f08ad261b9ca1e60688975d12177eeb6
File type: pe · Size: 56320 bytes
Verdict: malicious (99/100) · Family: Crypted

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Crypted-30
Microsoft Defender: Backdoor:Win32/Berbew.AA!MTB
Emsisoft (Emergency Kit): GenPack:Generic.Dacic.1.Backdoor.Hangup.A.004BF035
Trellix Stinger (McAfee): Trojan-FUGH!5A338AFEEEE5
Kaspersky (KVRT): Trojan-Proxy.Win32.Qukart.vih

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Trojan.Crypted-30 (rule Win.Trojan.Crypted-30) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Backdoor:Win32/Berbew.AA!MTB (rule Backdoor:Win32/Berbew.AA!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged GenPack:Generic.Dacic.1.Backdoor.Hangup.A.004BF035 (rule GenPack:Generic.Dacic.1.Backdoor.Hangup.A.004BF035) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FUGH!5A338AFEEEE5 (rule Trojan-FUGH!5A338AFEEEE5) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Proxy.Win32.Qukart.vih (rule Trojan-Proxy.Win32.Qukart.vih) - engine signal, weight 0.55, confidence 0.85
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Dropped 138 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

4428 behavior events · 1 ATT&CK techniques · 138 dropped files.

Dropped files

C:\Windows\System32\Bgcjibeo.exe - 5b9aa64d5ac7b26aa6fa3b8a51a55c18e7fa56c40bf0016ba6f476ee19ca3bad
C:\Windows\System32\Bmffhk32.exe - c6f988a35522880925e8c8feaa0a6e07091524d748fd90b95483095fedae286c
C:\Windows\System32\Ceamieln.exe - 11b80ea64ab58bcc3d9fb485ed72c2b7e05762795348f2a49af3d03e81211d31
C:\Windows\System32\Fgmipjnl.exe - 9bdec7951864a8f91968cb25e937acc35ebf9cbd4f6fc93f3316a6a6d098793c
C:\Windows\System32\Phbdei32.exe - 9d805b8b7409ffd13bd1ea5b64931ecbaf3181af925e998a64298bf0e6007fd5
C:\Windows\System32\Hjaaoeme.dll - 27d5b777f358aa4b093a0183e00a10fffee93806b3290dd1eaca91795f92bc7c
C:\Windows\System32\Jlkgph32.exe - 85b1b92f8c3364246ed5e02ef487ee9a4b918d342b53f7aa4c7d20241357bffb
C:\Windows\System32\Llofkg32.dll - 20c5ecc0447f62e53cbbe81793334f0c59ecb694feecc1b624c3cc9f8225d28b
C:\Windows\System32\Jebeej32.dll - 96538be78b2b1ff75e764348707b6c6cee799fdb5d1b3e82c3c66522cc121d78
C:\Windows\System32\Dbileh32.dll - 53873b09ebd599878588117d75fe5e729acac486a0492416110e254b8199ae2f
C:\Windows\System32\Jnhlam32.exe - e2fbf595279d348f54243ac1f3c5682e8c762aa35e92e6c90b44bbc01a35e06e
C:\Windows\System32\Pbkpie32.exe - 4bbc46f9f62093e44a0c4fc58285c5013364dc47dd7966a19ac309efa03e57ee
C:\Windows\System32\Bpilofko.exe - bde4865668c937db5ca49e6764a41db5ab97662ecdaee8ca03e92fddf1fc898c
C:\Windows\System32\Lonenp32.exe - 3b4bee004818783babab23011fa23e8127d622d2794f52d89acd6ed2669b6884
C:\Windows\System32\Jhfjdboc.dll - fcb1b0d5a7059198d30157a5c8d4de40d182a66653f8d728faf2d0facdf804cc

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

aefd.nelreports.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.117.175
52.230.59.222
52.123.252.239
4.230.171.124
172.178.240.161
20.42.73.28
172.215.188.225
92.223.78.30
52.148.114.188
52.110.12.2
52.110.12.26

More Crypted samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report