MALICIOUS — AT-consistency-4.exe

MALICIOUS — AT-consistency-4.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Shufab family. 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 644facb5d1a69147ceb20e58f654d41f53283d30e348fa918b36c3d335f407db
SHA-1: 2cb417a72e224460a0c4417cbf3ab041455b7ae3
MD5: 6a2ee4e37fbb45b30a0204d9d0707602
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 12288:5qIrEFD09leQEA49darfr3/2AbitnVYE96ltR:5AFD1A498H2D
TLSH: T1964AD589352C0B73C36259E60574D28B8DE360A33FED262049437D76D712EDB58A2B36
Submitted as: AT-consistency-4.exe
File type: pe · Size: 460804 bytes
Verdict: malicious (98/100) · Family: Shufab

Detections (4 of 53 engines)

Microsoft Defender: Trojan:MSIL/Shufab.A!bit
Emsisoft (Emergency Kit): Gen:Variant.msilheracles.128405
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
Trellix Stinger (McAfee): Packed-VL!6A2EE4E37FBB

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 11 weighted signals:

Microsoft Defender flagged Trojan:MSIL/Shufab.A!bit (rule Trojan:MSIL/Shufab.A!bit) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.msilheracles.128405 (rule Gen:Variant.msilheracles.128405) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Extracted AgentTesla config (0 C2) - engine signal, weight 0.45, confidence 0.60
Extracted AgentTesla config (0 C2) - engine signal, weight 0.45, confidence 0.60
Embedded network infrastructure: 6.9.1.5, 17.18.7.0 - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

7262 behavior events · 2 ATT&CK techniques · 13 dropped files.

Dropped files

3daa93b22601ecf778176338b1b5d845584cb99a8d67b2d0d224a64eeaad30b6 - 3daa93b22601ecf778176338b1b5d845584cb99a8d67b2d0d224a64eeaad30b6
3ee8acf49be6d718f214e22396cca984b869e64fa82980246cadcbb7e2c79556 - 3ee8acf49be6d718f214e22396cca984b869e64fa82980246cadcbb7e2c79556
ce225d64589e14f8ca17792329a6c75f6c1f0b006ae3a0a193ee780e49530be3 - ce225d64589e14f8ca17792329a6c75f6c1f0b006ae3a0a193ee780e49530be3
d0d572133e77af539706491e969a684d2ed6d91fafb211e5ede6e5dd29d1d9f2 - d0d572133e77af539706491e969a684d2ed6d91fafb211e5ede6e5dd29d1d9f2
d90b5715978afac3ccf30d0958634354d143edf6c23f9a4ce413d3f22916adc5 - d90b5715978afac3ccf30d0958634354d143edf6c23f9a4ce413d3f22916adc5
de2a0403854c6bc7b7216269fc08ec7dd56548d01961982d9d6318ee7d9d138c - de2a0403854c6bc7b7216269fc08ec7dd56548d01961982d9d6318ee7d9d138c
6b3dadad96cebac0a40dd80f1340326ce2787dc1b6b5b937addd1b0d75cc46fd - 6b3dadad96cebac0a40dd80f1340326ce2787dc1b6b5b937addd1b0d75cc46fd
daea0b90cd5e962bcbd68071f1f9242d7d2fb46975757a49eb0d0b5061ef0f65 - daea0b90cd5e962bcbd68071f1f9242d7d2fb46975757a49eb0d0b5061ef0f65
903f66d561e8c51904def1dcc14b2ef4daf4feb676430ef30303d7df90002d1d - 903f66d561e8c51904def1dcc14b2ef4daf4feb676430ef30303d7df90002d1d
8289c2e1e89ec9bb3a0ad8970d7d39c89e004a88084985534099d8610eee1fcc - 8289c2e1e89ec9bb3a0ad8970d7d39c89e004a88084985534099d8610eee1fcc
78ef733bb65f0bf89eead334898949985de16f629532c747ef60d38f30d339ad - 78ef733bb65f0bf89eead334898949985de16f629532c747ef60d38f30d339ad
8fd959a6d69eceb9b426999b912b9529e4e797a54de764d5e022ce0322d653bc - 8fd959a6d69eceb9b426999b912b9529e4e797a54de764d5e022ce0322d653bc
14bdcb3dfae1adf59138170b6eed571c837256a7dcc39e0e97ac53449909fe98 - 14bdcb3dfae1adf59138170b6eed571c837256a7dcc39e0e97ac53449909fe98

Embedded domains

checkip.dyndns.org
www.msftconnecttest.com
config.edge.skype.com
www.bing.com
dns.msftncsi.com
settings-win.data.microsoft.com
edge.microsoft.com
msedge.api.cdp.microsoft.com
aps.prod.windows.com
g.live.com
ecs.office.com
www.msftncsi.com
fs.microsoft.com
self.events.data.microsoft.com

Embedded IP addresses

6.9.1.5
17.18.7.0

More Shufab samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report