MALICIOUS — 67737737c883166c2f211d0dccdd9f6ce35fbbe0fbc50e9933d848df6ad18735

MALICIOUS — 67737737c883166c2f211d0dccdd9f6ce35fbbe0fbc50e9933d848df6ad18735 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Astaroth family. 4 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 67737737c883166c2f211d0dccdd9f6ce35fbbe0fbc50e9933d848df6ad18735
SHA-1: bd08cdb0eb73f2ca7e00a4d825c3e48ae87f93fb
MD5: f3972e7a4de1d3774d66c2c850ae6841
imphash: d0b8285184365a838ba34f4f2ef57766
ssdeep: 48:iqn+x7OyhnWmNwVaCzT6z4yRdBHAGmTAnn+YsC9A1lRm/WRLRym3eXURBPVKirI8:ipTlbCzO4aVSTmrqmuRLRVGUkvM+a
TLSH: T1D722DCCD40B82B66CB6654B61632C98D9296B0F208BDB55D6D4DC23851C28B7FE22D22
Submitted as: 67737737c883166c2f211d0dccdd9f6ce35fbbe0fbc50e9933d848df6ad18735
File type: pe · Size: 9840 bytes
Verdict: malicious (99/100) · Family: Astaroth

Detections (4 of 55 engines)

ClamAV (daily): Win.Downloader.Tiny-9940499-0
Microsoft Defender: Trojan:Win32/Astaroth.psyW!MTB
Emsisoft (Emergency Kit): Gen:Variant.Zbot.1134
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Downloader.Tiny-9940499-0 (rule Win.Downloader.Tiny-9940499-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

9509 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\fcbnaf.exe - 09ed83a1725feac983d0e3d919620459728b703a63567c28e484b74b85433921

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787925948&P2=404&P3=2&P4=boVyTZee2uhJkAbV993yDBD9iImS7JiNq3xDIJ9LK8Lzm8F1fA3z1%2b9dwrANahk%2fK8QWnTaM%2f2B7r41%2b%2biVTZw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787925964&P2=404&P3=2&P4=EikNb1TLxBjfcMkqzjzdbSWlAoAaK%2bGBaSzNZ9PV2HMOtVWK5CH7Vd68jghUn5SneoRuvEcxZSATYZCS6ktXBA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

huyontop.com

Embedded IP addresses

4.150.223.110
4.230.171.124
20.42.179.192
20.247.184.142
172.215.188.232
20.165.94.46
135.233.95.144
4.150.223.100
74.178.240.51
74.178.76.128
203.26.79.13
40.103.64.226
20.76.201.171
52.123.128.14
52.123.129.14
20.42.65.94
172.178.240.163
48.211.4.16
52.110.12.1
20.184.175.15
20.42.65.93
52.110.12.54
52.148.114.188
135.233.45.222
52.123.252.213

File paths

Z:\Projects\Loader\Release\Loader.pdb
C:\Users\admin\Downloads\fcbnaf.exe
C:\3cabf321df1512aa0674c8f3a7a022174209c742fde3914adf6325e9497fb94b
C:\sample.exe
C:\Users\george\Desktop\file000_fcbnaf.exe
C:\c84e79c2373317470929ca50a94eb50a4071a7388b534965d7288ab3baa69e7b
C:\Users\george\Desktop\fcbnaf.exe
C:\1629b01f3f39e6fa23380f3e125fc18874651a71f3713b19c76e19e59c3bb675
C:\21407bf34bb986e34e926c2805b86dd292ce1d7ef1c3e370e1091092396ffd23
C:\f2b12ba4bfc13f5a947bee0090470e0790b79aa08c70ac1976d61f1ebafbc361
C:\37a769727ec0fcb4396c2322e50fd4d9800a05296af560e073e168bef4f858eb
C:\Users\Virtual\AppData\Local\Temp\d8c0d25d38f3200adc72f6aa1035fc5c07ef79a53d5c4e7c978484ff6477f694.exe

More Astaroth samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report