MALICIOUS — photov_489461938126.lnk
MALICIOUS — photov_489461938126.lnk is a lnk sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the Ravartar family. 3 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
64f4dc9c84174283803b0262016229bd89a8a7aa4ce715300eea930ba3708037 - SHA-1:
342172b996da435ab29b1e3b9de3f0d6dcc0c4b6 - MD5:
0410b763a44c2ecda6dde192e5d82f01 - ssdeep:
48:8wDvr99nIbjAg6XnQ2nNqCUIImOqIedjn:86LIo1XQ2g1IthFdj - TLSH:
T16816CBCE139C4765D334C5AC923950EE0982F42A05BCEA054E4B8836190353BEEF3DB5 - Submitted as: photov_489461938126.lnk
- File type: lnk · Size: 2656 bytes
- Verdict: malicious (93/100) · Family: Ravartar
Detections (3 of 51 engines)
- Microsoft Defender: Trojan:Win32/Ravartar!rfn
- Emsisoft (Emergency Kit): Trojan.Generic.40346836
- Kaspersky (KVRT): HEUR:Trojan.WinLNK.Agent.gen
MITRE ATT&CK
Why this verdict
The malicious score of 93/100 is the fusion of 5 weighted signals:
- Memory forensics: 4 finding(s), e.g. RWX/private injected region in svchost.exe (pid 948) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Microsoft Defender flagged Trojan:Win32/Ravartar!rfn (rule
Trojan:Win32/Ravartar!rfn) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Generic.40346836 (rule
Trojan.Generic.40346836) - engine signal, weight 0.55, confidence 0.85 - Shortcut launches: powershell - static signal, weight 0.50, confidence 0.80
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
2548 behavior events · 1 ATT&CK techniques · 9 dropped files.
Runtime network
- none
Dropped files
- /opt/CAPEv2/storage/analyses/5671/files/6266e7c1afdb5ff197bc11f42cfc7e3b15a8b285ff61d344498de9cf448d01f5 -
6266e7c1afdb5ff197bc11f42cfc7e3b15a8b285ff61d344498de9cf448d01f5 - /opt/CAPEv2/storage/analyses/5671/files/2734b892dcdc9af0cff328da6d048744a66854e1a6df3905cd1978dd853208dd -
2734b892dcdc9af0cff328da6d048744a66854e1a6df3905cd1978dd853208dd - 46c082bb6ef316bc0885e4276f1f494077ed588e0ccba41394aef77dc968b377 -
46c082bb6ef316bc0885e4276f1f494077ed588e0ccba41394aef77dc968b377 - 4d620c5899cc9f90c3e7007d708ab783927383aec5979b8ab437a9988cadfcd4 -
4d620c5899cc9f90c3e7007d708ab783927383aec5979b8ab437a9988cadfcd4 - e9f50b2bf90c6f9c8cff3dd861a2ecf15566a96d1c27ce012ff945eb5c45f6fa -
e9f50b2bf90c6f9c8cff3dd861a2ecf15566a96d1c27ce012ff945eb5c45f6fa - f7a7c275a72c8767b76ba376bb1f34b09bf49fcdefff0ef2669d8cc36e7157f0 -
f7a7c275a72c8767b76ba376bb1f34b09bf49fcdefff0ef2669d8cc36e7157f0 - 4410e50377a89d7380bfac0e925718f4094b802ebb4f8c711ee09d021441335f -
4410e50377a89d7380bfac0e925718f4094b802ebb4f8c711ee09d021441335f - 8be63413ab0655b90b8e2d346ff47b385bc20cd9c8eeb5ca32524a1626ca1c70 -
8be63413ab0655b90b8e2d346ff47b385bc20cd9c8eeb5ca32524a1626ca1c70 - 50d88c855407cd6268ab8492561c77f0d3d2327a8ce6661bc682fcd1dfc3200f -
50d88c855407cd6268ab8492561c77f0d3d2327a8ce6661bc682fcd1dfc3200f
More Ravartar samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report