MALICIOUS — 5c5e550350ec4651f04203623c890d5c327e688c7f3b4221b8e86276026809cd
MALICIOUS — 5c5e550350ec4651f04203623c890d5c327e688c7f3b4221b8e86276026809cd is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the AntiDebug family. 4 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.
Identification
- SHA-256:
5c5e550350ec4651f04203623c890d5c327e688c7f3b4221b8e86276026809cd - SHA-1:
cf2aa409f1bfc7e733816bfee4d018eabd8d08f0 - MD5:
648d637c8979dd3bf3432012e5d15249 - imphash:
f34d5f2d4577ed6d9ceec516c1f5a744 - ssdeep:
196608:PgRGmiafHvZlR81+x2ug1nqwzyaMfHt6ZE6bBWde:PcisPZle1+cuYMPEZEQWd - TLSH:
T10C6A12849CA29CCFCBB17A570F8720DD0F96E4BB2406D897B4A5CB89406CD4B29D1E17 - Submitted as: 5c5e550350ec4651f04203623c890d5c327e688c7f3b4221b8e86276026809cd
- File type: pe · Size: 9545216 bytes
- Verdict: malicious (97/100) · Family: AntiDebug
Detections (4 of 56 engines)
- capa (capabilities): capability:execution/powershell
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.#CS-RET
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Kaspersky (KVRT): VHO:Trojan.MSIL.Exnet.gen
MITRE ATT&CK
Why this verdict
The malicious score of 97/100 is the fusion of 11 weighted signals:
- Kaspersky (KVRT) flagged VHO:Trojan.MSIL.Exnet.gen (rule
VHO:Trojan.MSIL.Exnet.gen) - engine signal, weight 0.55, confidence 0.85 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - execute via PowerShell (rule
execute via PowerShell) - capa signal, weight 0.40, confidence 0.80 - Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
- YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - capa (capabilities) flagged capability:execution/powershell (rule
capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.#CS-RET (rule
high-entropy-sections:.#CS-RET) - engine signal, weight 0.35, confidence 0.70 - 1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule
tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90 - Packing/obfuscation: high-entropy-sections:.#CS-RET - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
13796 behavior events · 2 ATT&CK techniques · 5 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- windows.msn.com
- www.msn.com
- licensing.mp.microsoft.com
- assets.msn.com
- www.bing.com
Dropped files
- 7943fa5893526a5f38d654f13f5a4187a1996914f578ff1eee26bea5256e0869 -
7943fa5893526a5f38d654f13f5a4187a1996914f578ff1eee26bea5256e0869 - 7df599a4f97d6e6138ae0fa624ac7a5171621efc1db7df1042bf088fde815abf -
7df599a4f97d6e6138ae0fa624ac7a5171621efc1db7df1042bf088fde815abf - 4fab6e3ca1ff501a12a2a6c5f4e72bf9e176ddd0aec6b9db2d79af14c0232991 -
4fab6e3ca1ff501a12a2a6c5f4e72bf9e176ddd0aec6b9db2d79af14c0232991 - 6107bcf14fd59e86484c70e46c68f9334c5b8f9a1591fdb0c42039cb05d99e0d -
6107bcf14fd59e86484c70e46c68f9334c5b8f9a1591fdb0c42039cb05d99e0d - e1f6a831cfcc36382a41d96d88d1a9ec0b985124b5de0f328cdcbaa061ba39be -
e1f6a831cfcc36382a41d96d88d1a9ec0b985124b5de0f328cdcbaa061ba39be
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
- http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
- http://yr.c.lencr.org/
Embedded domains
- s.co
- 0.ga
- 5.ca
- x.co
- v.cf
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 4.150.223.110
- 4.230.171.124
- 4.144.132.114
- 135.233.45.223
- 40.79.197.34
- 20.42.73.24
- 20.42.179.192
- 20.42.179.204
- 52.110.12.46
- 52.110.12.55
- 72.145.35.97
- 52.148.114.188
File paths
- E:\He
- O:\~5k(Cv
- P:\HBS.
- E:\I&
More AntiDebug samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report