MALICIOUS — 608e41fadb1bf213387ce10c4aa5ccdff23c6742b6a88072bd7374652e47aba0

MALICIOUS — 608e41fadb1bf213387ce10c4aa5ccdff23c6742b6a88072bd7374652e47aba0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Hoax family. 7 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 608e41fadb1bf213387ce10c4aa5ccdff23c6742b6a88072bd7374652e47aba0
SHA-1: 5c7a0811b775bc7ec60673fa42ab368977db0852
MD5: cafed06d4495bf38290e1992a0857a55
imphash: 0818438d729451edf8c455424695687b
ssdeep: 768:vCru/f9Iw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpRiTWNReOOt:71Tzy48untU8fOMEI3jyYfPiuOt
TLSH: T1B3352A9DCE80CD4AE5A4AAA3B024DC5D4025A4F3FEF7329930D1F46A1CE0C9734597A9
Submitted as: 608e41fadb1bf213387ce10c4aa5ccdff23c6742b6a88072bd7374652e47aba0
File type: pe · Size: 61928 bytes
Verdict: malicious (100/100) · Family: Hoax

Detections (7 of 56 engines)

capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): PureBasic
ClamAV (daily): Win.Malware.Hoax-10019944-0
Detect It Easy (packer/type): DIE:PureBasic
Microsoft Defender: Trojan:Win32/Lazy.AB!MTB
Emsisoft (Emergency Kit): Trojan.Generic.32454626
Kaspersky (KVRT): Hoax.Win32.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Hoax-10019944-0 (rule Win.Malware.Hoax-10019944-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Lazy.AB!MTB (rule Trojan:Win32/Lazy.AB!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Generic.32454626 (rule Trojan.Generic.32454626) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Hoax.Win32.Agent.gen (rule Hoax.Win32.Agent.gen) - engine signal, weight 0.55, confidence 0.85
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:PureBasic (rule DIE:PureBasic) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged PureBasic (rule PureBasic) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: PureBasic - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1589 behavior events · 0 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\D997.tmp\1.bat - 8b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
C:\Users\analyst\AppData\Local\Temp\~%TargetName%.DDF - 29ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
C:\Users\analyst\AppData\Local\Temp\popup.sed - ad36dac0923ca311fc2aa026967eb8c641a1314c73cd9cf8732db3a216c8da34

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.signs101.com

Embedded IP addresses

4.150.223.111
20.247.184.142
52.123.252.230
57.155.101.212
4.230.171.124
52.110.12.33
52.110.12.10
172.64.154.167
85.210.193.152
72.145.35.110
52.148.114.188
52.110.12.46
52.110.12.16

File paths

C:\Windows\System32\
C:\\popupe.exe
C:\Raiden\Goat\FTP\Sample\popupe.exe
C:\WINDOWS\system32\popupe.exe
C:\Documents
C:\Users\luser\Desktop\popupe.exe
C:\Users\Frank\Desktop\popupe.exe
c:\\popupe.exe
C:\Users\Lisa\Desktop\popupe.exe
C:\Users\george\Desktop\popupe.exe

More Hoax samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report