MALICIOUS — 5fc9d6fac3c8d64818aad10538ecd797318570d83cea559bc8754abf73596130

MALICIOUS — 5fc9d6fac3c8d64818aad10538ecd797318570d83cea559bc8754abf73596130 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Autorun family. 4 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 5fc9d6fac3c8d64818aad10538ecd797318570d83cea559bc8754abf73596130
SHA-1: a6b7c1e2e42de95c00a2221aa05fa932517d95dc
MD5: 7e59a5c9da554bf42e4501a34c321429
imphash: 1000cf882e08f17da2dc5a24f96c3baa
ssdeep: 768:gqGPbKIu1PaTaruTFlhFM/aCKdN27fx0Xn6YOD5ryTlS:gtPbmTralD8K727fxi6YtS
TLSH: T17F3832DF05539480ECF3E45B3A9AAE9E108EE6218B33169D3957210F358533BD839A5C
Submitted as: 5fc9d6fac3c8d64818aad10538ecd797318570d83cea559bc8754abf73596130
File type: pe · Size: 77824 bytes
Verdict: malicious (100/100) · Family: Autorun

Detections (4 of 56 engines)

ClamAV (daily): Win.Worm.Autorun-440
Microsoft Defender: Worm:Win32/Vobfus.AC
Emsisoft (Emergency Kit): Gen:Trojan.Chinky.2
Kaspersky (KVRT): Worm.Win32.Vobfus.exjr

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Worm.Autorun-440 (rule Win.Worm.Autorun-440) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Worm:Win32/Vobfus.AC (rule Worm:Win32/Vobfus.AC) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Trojan.Chinky.2 (rule Gen:Trojan.Chinky.2) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.Vobfus.exjr (rule Worm.Win32.Vobfus.exjr) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

62614 behavior events · 3 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Users\analyst\sueoraq.exe - 8da7fa490d5d57c9dba0d237640c11b7e175880bf7b67978fc9301afd730d605
698ca1f0c6d821134eb3468372dc2d846133d6dabcc441ba5af61108db785d9f - 698ca1f0c6d821134eb3468372dc2d846133d6dabcc441ba5af61108db785d9f
6d5f681c3234c97fc09b3426afd728604ca73044855a265fc210decc711e2acf - 6d5f681c3234c97fc09b3426afd728604ca73044855a265fc210decc711e2acf
05ca45ff00cbcab9471e4431c1296e8fb0b9661896eb1d986db7d94487e56cdb - 05ca45ff00cbcab9471e4431c1296e8fb0b9661896eb1d986db7d94487e56cdb

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

ns4.thepicturehut.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
oneclient.sfx.ms

Embedded IP addresses

52.253.84.76
20.184.175.13
4.230.171.124
172.64.154.167
52.110.12.28
52.110.12.19
20.42.179.192
172.178.240.161
40.84.85.40
51.116.246.104
52.178.17.2
172.172.255.218
52.148.114.188
72.153.5.135
52.110.12.37
52.110.12.2
20.42.179.204
40.79.167.10

More Autorun samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report