MALICIOUS — malware.ex~
MALICIOUS — malware.ex~ is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the EyeStye family. 6 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
664a551f2dfb0cebf3d17d80e60d6fccf82b6b7f0dfeb0b8b715810e93555c01 - SHA-1:
1dca672c62538457be0cfbccb6880c09d64d55b3 - MD5:
7779f923da8c1418764fecc7d1ba86cf - imphash:
8a1af7378d2f4f57d2dc9b02aecf4549 - ssdeep:
3072:oBCtQr2DkD0lRLb+4hLTyU06Y0a+rkaOQ7n4EXhMpe:oCQrZD0XRh0Z0aZah7n/hME - TLSH:
T1573E129EA26013B2C8F76F6433CA374DB7421524599CDF82F589ED726EA2B0B08DC150 - Submitted as: malware.ex~
- File type: pe · Size: 136704 bytes
- Verdict: malicious (99/100) · Family: EyeStye
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Trojan.Agent-378573
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Trojan:Win32/EyeStye
- Emsisoft (Emergency Kit): Trojan.Rootkit.Agent.NGK
- Kaspersky (KVRT): Trojan-Spy.Win32.SpyEyes.df
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 9 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Agent-378573 (rule
Win.Trojan.Agent-378573) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/EyeStye (rule
Trojan:Win32/EyeStye) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Rootkit.Agent.NGK (rule
Trojan.Rootkit.Agent.NGK) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Trojan-Spy.Win32.SpyEyes.df (rule
Trojan-Spy.Win32.SpyEyes.df) - engine signal, weight 0.55, confidence 0.85 - Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
- Extracted SpyEye config (0 C2) - engine signal, weight 0.45, confidence 0.60
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
1505 behavior events · 1 ATT&CK techniques · 48 dropped files.
Runtime network
- none
Dropped files
- /opt/CAPEv2/storage/analyses/6489/files/c0cf13788fe44ce7087282f82fecef1597f9e34517f32b03b382ce0068a15df8 -
c0cf13788fe44ce7087282f82fecef1597f9e34517f32b03b382ce0068a15df8 - /opt/CAPEv2/storage/analyses/6489/files/37e6d8f47badb836b0ba7bc3c750e16ab082f8d15164e8979e089e81cb79cffa -
37e6d8f47badb836b0ba7bc3c750e16ab082f8d15164e8979e089e81cb79cffa - /opt/CAPEv2/storage/analyses/6489/files/fe0fd7cad403118ae7004ab00f1270e1a9a0058f222e2f6d62fd37b46cc9b677 -
fe0fd7cad403118ae7004ab00f1270e1a9a0058f222e2f6d62fd37b46cc9b677 - /opt/CAPEv2/storage/analyses/6489/files/9ad337a54337da535a9fbbf7fe94e18ce10003a5bd8e74140a0c2fe622a7f180 -
9ad337a54337da535a9fbbf7fe94e18ce10003a5bd8e74140a0c2fe622a7f180 - /opt/CAPEv2/storage/analyses/6489/files/0c25b890b1d166df75e7b7597b2d5a05fa3b8f8039b0ae7bd37c71bc066d1907 -
0c25b890b1d166df75e7b7597b2d5a05fa3b8f8039b0ae7bd37c71bc066d1907 - /opt/CAPEv2/storage/analyses/6489/files/f5ebff30d6f53cf221deecff3caa5775eeda0692967a6e0f4ee630d6d277f3aa -
f5ebff30d6f53cf221deecff3caa5775eeda0692967a6e0f4ee630d6d277f3aa - /opt/CAPEv2/storage/analyses/6489/files/388575690a7fed2e7d8e35db71e0455432516848263a2e0bb7afa178bda510ab -
388575690a7fed2e7d8e35db71e0455432516848263a2e0bb7afa178bda510ab - /opt/CAPEv2/storage/analyses/6489/files/d53759f40d77df0a6446749788ddd6ac7aaf02cd49998fd538308feb8b9bc5a2 -
d53759f40d77df0a6446749788ddd6ac7aaf02cd49998fd538308feb8b9bc5a2 - /opt/CAPEv2/storage/analyses/6489/files/df23345e04072c4fe674f747f89429cb03d8b6be9ce8aa2189485058efe4ef71 -
df23345e04072c4fe674f747f89429cb03d8b6be9ce8aa2189485058efe4ef71 - /opt/CAPEv2/storage/analyses/6489/files/09c2b7208ab40c7e595db77cf263cc8ac902956e534a184f76f63d5995e69544 -
09c2b7208ab40c7e595db77cf263cc8ac902956e534a184f76f63d5995e69544 - /opt/CAPEv2/storage/analyses/6489/files/218d8039fab476d8656ca6e09cbc2ebda2ebcd5c08e938e850600478e747abf1 -
218d8039fab476d8656ca6e09cbc2ebda2ebcd5c08e938e850600478e747abf1 - /opt/CAPEv2/storage/analyses/6489/files/cb0c5926ca751417abd8edc78cf234fee301aaca47ef9ccf3e414ae68acb1ad4 -
cb0c5926ca751417abd8edc78cf234fee301aaca47ef9ccf3e414ae68acb1ad4 - /opt/CAPEv2/storage/analyses/6489/files/f8a20491f2dc87e6a1f3ca563eebe262f99f4232d3116d9586de001778f6e25d -
f8a20491f2dc87e6a1f3ca563eebe262f99f4232d3116d9586de001778f6e25d - /opt/CAPEv2/storage/analyses/6489/files/a28c130281d1dc2aa0ad6980b63c620414052acb78b1b2dc94e8a4baf5f6dfc5 -
a28c130281d1dc2aa0ad6980b63c620414052acb78b1b2dc94e8a4baf5f6dfc5 - /opt/CAPEv2/storage/analyses/6489/files/0c01bd088f3ad4d05c103470bc6eeb7b5570378c51905b3fb03cdbae428ece7a -
0c01bd088f3ad4d05c103470bc6eeb7b5570378c51905b3fb03cdbae428ece7a
More EyeStye samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report