MALICIOUS — 5f186ada5266e635339e293c934a40d81883c6b1549451fc1daa62c60a086d37

MALICIOUS — 5f186ada5266e635339e293c934a40d81883c6b1549451fc1daa62c60a086d37 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the VBGeneric family. 3 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 5f186ada5266e635339e293c934a40d81883c6b1549451fc1daa62c60a086d37
SHA-1: f2e4ac653680c4b2e825c2d144b67affa3f5449f
MD5: edce43bc0b7f40d1756ec749a12394c8
imphash: fb3d0a9cf63dfa8698555596b6c0c5e8
ssdeep: 384:jYxWwue/4youZfWkXiWgEiSZexdiHsd2E0S8NrjpWKV:jYx+6dWailEl0iMk6ErkA
TLSH: T1D34BC7EE0F32DE80C9B1CE83F4C91A1D2053396037A9514DA756959BA7F38A7683C42D
Submitted as: 5f186ada5266e635339e293c934a40d81883c6b1549451fc1daa62c60a086d37
File type: pe · Size: 482504 bytes
Verdict: malicious (98/100) · Family: VBGeneric

Detections (3 of 56 engines)

ClamAV (daily): Win.Trojan.VBGeneric-6735817-0
Microsoft Defender: TrojanDropper:Win32/VBInject
Kaspersky (KVRT): UDS:Trojan-Dropper.Win32.VB.gen

MITRE ATT&CK

T1057

Why this verdict

The malicious score of 98/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Trojan.VBGeneric-6735817-0 (rule Win.Trojan.VBGeneric-6735817-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged TrojanDropper:Win32/VBInject (rule TrojanDropper:Win32/VBInject) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan-Dropper.Win32.VB.gen (rule UDS:Trojan-Dropper.Win32.VB.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 4 external host(s) and 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

28319 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\VI4C8F.tmp - a81f0b16243d1a70181754e481a1098fb3b9b0b801eb939459d8141a84215fad

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788190106&P2=404&P3=2&P4=YRI5DyFZthARpilsdblz1jAKSQZohiwi4J7VGmiyOU3BvHU666rKhOxDnQpEWbBwCPzoxvwaJjFVuFH8BXxOvA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.100
135.233.95.144
4.230.171.124
4.247.188.233
135.232.92.97
20.184.175.10
20.247.184.197
20.42.65.90
40.74.98.198
52.168.117.169
57.155.104.224
125.56.205.24
125.56.205.51
52.148.114.188
135.234.160.244
52.110.12.1
52.110.12.22
72.145.35.100
52.110.12.51
52.110.12.30
203.26.79.13
125.56.205.32
172.172.255.217
20.165.94.46
125.56.205.42

More VBGeneric samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report