MALICIOUS — 6292e1f0303fb5df18ebbd11073bc4ff62365fa63eeff2ed3fa386acb2e14d95

MALICIOUS — 6292e1f0303fb5df18ebbd11073bc4ff62365fa63eeff2ed3fa386acb2e14d95 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Potentialdownloader family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 6292e1f0303fb5df18ebbd11073bc4ff62365fa63eeff2ed3fa386acb2e14d95
SHA-1: d4fc05b0e0835eb4a265ea1460895ead91bc9c5a
MD5: 819a4c739e44e158d4ad1ee389d9f97e
imphash: dc6bbd141bb3857737e5f17c9aa78eed
ssdeep: 384:hVHFc1M/CQVfetcLl3pxB3HEKvgXARlg8KTWlBgqmXTHO3fR7GcJhNo2VpgMqvY:hPzCc/J5DzCmOWfgqmjHmpCv
TLSH: T1B32F7C1EFA30B88EF688B75445028C0D8261F2FEA57DBD8B159CED6D9DE80137844994
Submitted as: 6292e1f0303fb5df18ebbd11073bc4ff62365fa63eeff2ed3fa386acb2e14d95
File type: pe · Size: 32768 bytes
Verdict: malicious (99/100) · Family: Potentialdownloader

Detections (5 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: TrojanDownloader:Win32/Potentialdownloader!rfn
Emsisoft (Emergency Kit): Gen:Variant.Adware.Barys.61935
Kaspersky (KVRT): UDS:Trojan.Win32.Zapchast.a

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged TrojanDownloader:Win32/Potentialdownloader!rfn (rule TrojanDownloader:Win32/Potentialdownloader!rfn) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Adware.Barys.61935 (rule Gen:Variant.Adware.Barys.61935) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan.Win32.Zapchast.a (rule UDS:Trojan.Win32.Zapchast.a) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

34 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.babybeddingtown.com

Embedded IP addresses

4.150.223.97
4.144.132.114
4.230.171.124
20.165.94.54
20.42.179.192
52.182.143.212
74.178.76.128
57.154.63.210
72.153.5.60
52.148.114.188
52.110.12.26
52.110.12.4

More Potentialdownloader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report