MALICIOUS — 61d8dbfd19d077e6fb7c8a1d7ade82a30e8b9498b731313969097e3786b6e0b3

MALICIOUS — 61d8dbfd19d077e6fb7c8a1d7ade82a30e8b9498b731313969097e3786b6e0b3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the PolyRansom family. 6 of 51 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 61d8dbfd19d077e6fb7c8a1d7ade82a30e8b9498b731313969097e3786b6e0b3
SHA-1: 4960efad3b2c606e051ee7c7ec4f1d26f6382dc0
MD5: 3195ababbf261c2863a2d5f6d66e65ca
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 24576:7www8wwwoWbtOgYlIJlXJELeaKLGpXE9HOI0URCqX79:G3YiJlmYKpXQuIRR
TLSH: T1DA58CB0D72FADDBF794E0633C3F5B624D0F362A1D604CD6A4BDA18AA418046446DF6E8
Submitted as: 61d8dbfd19d077e6fb7c8a1d7ade82a30e8b9498b731313969097e3786b6e0b3
File type: pe · Size: 1681920 bytes
Verdict: malicious (99/100) · Family: PolyRansom

Detections (6 of 51 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): BC.Win.Virus.Ransom-9157.B
Kaspersky (KVRT): Virus.Win32.PolyRansom.a
Microsoft Defender: Trojan:Win32/NabucurObfs
Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
Trellix Stinger (McAfee): W32/VirRansom

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged BC.Win.Virus.Ransom-9157.B (rule BC.Win.Virus.Ransom-9157.B) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 5 finding(s), e.g. RWX/private injected region in vcIYEIkQ.exe (pid 3460) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 35 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

35385 behavior events · 2 ATT&CK techniques · 20 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/6938/files/37bf17a9f2639e28ae391a1bd8dd52b2a997d794447aefa92d5376f9e11653c1 - 37bf17a9f2639e28ae391a1bd8dd52b2a997d794447aefa92d5376f9e11653c1
/opt/CAPEv2/storage/analyses/6938/files/b8bb03867c57af8e27bcd3921e5b629103b005895c8939192b0c0f91c5054f79 - b8bb03867c57af8e27bcd3921e5b629103b005895c8939192b0c0f91c5054f79
/opt/CAPEv2/storage/analyses/6938/files/d918af5263435d86b42a73cce0e20925c28e6a5076c18b4d106126aedf6dcdaf - d918af5263435d86b42a73cce0e20925c28e6a5076c18b4d106126aedf6dcdaf
/opt/CAPEv2/storage/analyses/6938/files/3d817c1fe7db932f0cdf739144978cc0283d0ddaf0fce41c85797669d233cba9 - 3d817c1fe7db932f0cdf739144978cc0283d0ddaf0fce41c85797669d233cba9
/opt/CAPEv2/storage/analyses/6938/files/12c8a2e895eb10fe9fa999402f3c954c340672080f998d41ec19b50d99add1a8 - 12c8a2e895eb10fe9fa999402f3c954c340672080f998d41ec19b50d99add1a8
/opt/CAPEv2/storage/analyses/6938/files/18aded64c370ff6ebc5c740070ab0557e4cbeec07f88f7af6fbdf6e41b46858b - 18aded64c370ff6ebc5c740070ab0557e4cbeec07f88f7af6fbdf6e41b46858b
/opt/CAPEv2/storage/analyses/6938/files/dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d - dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d
/opt/CAPEv2/storage/analyses/6938/files/bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620 - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620
/opt/CAPEv2/storage/analyses/6938/files/d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698 - d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698
/opt/CAPEv2/storage/analyses/6938/files/ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51 - ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51
/opt/CAPEv2/storage/analyses/6938/files/bf06e97fa140c8e67df2f234084ed0451c203beda0aace7357c9c0a1bd288be9 - bf06e97fa140c8e67df2f234084ed0451c203beda0aace7357c9c0a1bd288be9
/opt/CAPEv2/storage/analyses/6938/files/5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e - 5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e
/opt/CAPEv2/storage/analyses/6938/files/642cb40043509ee78499e1ba874f55b38089f3ed4ac0495ca1628f2cf3679a96 - 642cb40043509ee78499e1ba874f55b38089f3ed4ac0495ca1628f2cf3679a96
/opt/CAPEv2/storage/analyses/6938/files/52a79b30573fb502d93654a6dbc5a0993b9b06f25fa01f96c8b9715086d94fd0 - 52a79b30573fb502d93654a6dbc5a0993b9b06f25fa01f96c8b9715086d94fd0
/opt/CAPEv2/storage/analyses/6938/files/ab4dbdfd0daf85a5992ad7bfb28a1a3330321a715c6573f5dbdaa4650c0d8a38 - ab4dbdfd0daf85a5992ad7bfb28a1a3330321a715c6573f5dbdaa4650c0d8a38

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://google.com/
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786233750&P2=404&P3=2&P4=T29G66oMCRXPUnqq5YGkpDXWQlKzMZiQOVJJnS2Cq13I2amwvtN6P8%2bgAmtDSEdxi2IMGX9EELGFeUxXV2%2f5ZA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786233912&P2=404&P3=2&P4=Uv7YOBDruy6dMz09oMpwYzKVOCHb4uCEXpzirZ8cee2O97q%2fr9%2fLT0zY2yl1FuVRS41XxBBIpxzcv6MzeSMbFQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

4.150.223.109
4.144.132.223
52.230.59.222
52.123.252.192
4.230.171.124
4.247.188.224
74.178.240.51
57.155.104.224
20.184.175.3
74.178.240.61
4.150.223.103
172.178.240.163
200.87.164.69
200.119.204.12
203.26.79.13
190.186.45.170
20.165.94.46
72.145.35.103
52.148.114.188
142.251.222.238
52.110.12.30
172.217.25.174
52.110.12.19

More PolyRansom samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report