MALICIOUS — 66e06ba8a0d27d6115e7e63be3de7b7479ee4f9a8bfba10cf6b89b53157ebe1b

MALICIOUS — 66e06ba8a0d27d6115e7e63be3de7b7479ee4f9a8bfba10cf6b89b53157ebe1b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the VBKrypt family. 5 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 66e06ba8a0d27d6115e7e63be3de7b7479ee4f9a8bfba10cf6b89b53157ebe1b
SHA-1: 7fd409339f9ed0c4cdc9b28002473b597cdfcd0f
MD5: dd0d30719a739a1ece4d6f1e09143b67
imphash: e8c56ceba04f54b5a48a3994788c0cd5
ssdeep: 1536:xgiDdl1Rabaja3ataQ5qOBHyi9Zx0klo:LDdXno
TLSH: T12044B9E8A044F11ADA15F18C550AC9CE5D8ECE44D658D8867CBF8B4B37E131BD8898EC
Submitted as: 66e06ba8a0d27d6115e7e63be3de7b7479ee4f9a8bfba10cf6b89b53157ebe1b
File type: pe · Size: 249856 bytes
Verdict: malicious (99/100) · Family: VBKrypt

Detections (5 of 55 engines)

ClamAV (daily): Win.Trojan.VB-1326
Microsoft Defender: Worm:Win32/Vobfus!pz
Emsisoft (Emergency Kit): Gen:Variant.Midie.77325
Trellix Stinger (McAfee): Downloader-CJX.gen.j
Kaspersky (KVRT): Trojan.Win32.VBKrypt.csjv

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Trojan.VB-1326 (rule Win.Trojan.VB-1326) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 31 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

59184 behavior events · 3 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Users\analyst\qiuahib.exe - ca50a0481d0534a004aaea5e2bdc9206b640343f055c27baac565a58ab915e54
4b93085e97b30eaf5768db83f0725924a2d26836cf08c6c07c176a88e4cb4233 - 4b93085e97b30eaf5768db83f0725924a2d26836cf08c6c07c176a88e4cb4233
24ecaa71a42615b3357372bafcb07622fe0fac2746b6c889a456063991fe36a7 - 24ecaa71a42615b3357372bafcb07622fe0fac2746b6c889a456063991fe36a7
0512d8c736085f3f98ba1bb56720c657eb5e822bf4606b84afeeea9fba0f1114 - 0512d8c736085f3f98ba1bb56720c657eb5e822bf4606b84afeeea9fba0f1114
1205a81fabc36f45ac5d373bd2b7e97af70683c88550ecc8890b79b9786b2707 - 1205a81fabc36f45ac5d373bd2b7e97af70683c88550ecc8890b79b9786b2707
dc8124729dd29955ed406d3e109ebb7e29b6353782bb65efd415c3a3bf01d2b3 - dc8124729dd29955ed406d3e109ebb7e29b6353782bb65efd415c3a3bf01d2b3

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787911000&P2=404&P3=2&P4=FR%2bccQSNNYm0UOz70UiZunj6PmZVNBsn4z8rzffd8eio7Kocu%2bzatxXth%2bMfuKCcpuhlkkr3kzLjDiPKi%2fB4uA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787911042&P2=404&P3=2&P4=IgSJYAdiLlkM%2biu8Or8jjgca1lmYkTPS6VQlX%2ftKG%2fhFuB%2fBd6Is2sBi6Vc9uSHZtiFXXJm%2bnITdW3%2bBjK8UNA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787307770&P2=404&P3=2&P4=WDA0MkRz3inJLDxDZpARW7bvdonQKYZyeL8321XUahxE1Y%2bkS81DIgBLsa92CrNHQrAFpgjvw4PKQuqV7TCs1A%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787307323&P2=404&P3=2&P4=IedgXQiDF8R5QQ56h4l7OnIoM1X5J%2fjND9Q6r7dBBJ4gcatwDUfFQzAJyQC6j47WUkUU74RKm21lSFAQS00G4g%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787911042&P2=404&P3=2&P4=fpGNfOA1b8U0d0xIJL00E%2bcgEGXiPnikYGIHBtwDRB7z3eQmlbuC3K30dUKHvnNBv7LhqERHiFL7lO%2b8rT619w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ns1.player1523.com
ns1.videoall.net
ns1.mediashares.org

Embedded IP addresses

20.184.175.16
4.230.171.124
57.154.63.210
52.253.84.76
74.178.76.128
20.184.175.22
74.178.76.54
52.123.128.14
20.236.44.162
162.159.142.9
52.123.129.14
40.103.64.226
20.42.65.93
172.178.240.163
203.26.79.13
74.178.76.44
52.110.12.28
52.110.12.47
52.148.114.188
135.233.45.223
72.145.35.111
20.42.179.204
104.208.16.94
4.207.44.71
172.175.111.170

More VBKrypt samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report