MALICIOUS — 6904fbeabf2f3cf882d2cf08ed800225c89ff14514fbfc7aadceacfd50138907

MALICIOUS — 6904fbeabf2f3cf882d2cf08ed800225c89ff14514fbfc7aadceacfd50138907 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Gamaredon family. 6 of 52 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 6904fbeabf2f3cf882d2cf08ed800225c89ff14514fbfc7aadceacfd50138907
SHA-1: 25ee5ddb716e77fe941011c6835c8cd928bcd16b
MD5: 280977aefcfe14e19395082957aa0ce0
imphash: 69b6867f8f2741c550a03eff9f56e771
ssdeep: 6144:k2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDh1v:k2TFafJiHCWBWPMjVWrXf1v
TLSH: T1EB478C5492269251DAF2DB587DA13E1E2073F09A91BE2DC842C3C33F3298DB7E452257
Submitted as: 6904fbeabf2f3cf882d2cf08ed800225c89ff14514fbfc7aadceacfd50138907
File type: pe · Size: 335362 bytes
Verdict: malicious (100/100) · Family: Gamaredon

Detections (6 of 52 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Qakbot-9860983-1
Microsoft Defender: Trojan:Win32/Gamaredon!pz
Emsisoft (Emergency Kit): Generic.Dacic.7087E16C.A.0883C4BF
Trellix Stinger (McAfee): Trojan-FUMH!280977AEFCFE
Kaspersky (KVRT): Trojan.Win32.Agent.nevpvs

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Qakbot-9860983-1 (rule Win.Malware.Qakbot-9860983-1) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. RWX/private injected region in svchost.exe (pid 936) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Gamaredon!pz (rule Trojan:Win32/Gamaredon!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Generic.Dacic.7087E16C.A.0883C4BF (rule Generic.Dacic.7087E16C.A.0883C4BF) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FUMH!280977AEFCFE (rule Trojan-FUMH!280977AEFCFE) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 32 external host(s) at runtime (25 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

26518 behavior events · 2 ATT&CK techniques · 9 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/14288/files/621c9a375d924290df6803f2d83e74982da8e709124bdff7fb2f0541e02445ec - 621c9a375d924290df6803f2d83e74982da8e709124bdff7fb2f0541e02445ec
/opt/CAPEv2/storage/analyses/14288/files/1e33641828b0ec6c7a1be1477c7824215d8bbcfa2ba6bd39fd621baf06f634c8 - 1e33641828b0ec6c7a1be1477c7824215d8bbcfa2ba6bd39fd621baf06f634c8
/opt/CAPEv2/storage/analyses/14288/files/deaab1ffbaf1707712e7bbf99a0d590d98e8415c356829483af82023a0e30bd1 - deaab1ffbaf1707712e7bbf99a0d590d98e8415c356829483af82023a0e30bd1
/opt/CAPEv2/storage/analyses/14288/files/69dfd70c5b861ddfbd6eeddff3e58956663a1954eb817820b77c3f65621155cd - 69dfd70c5b861ddfbd6eeddff3e58956663a1954eb817820b77c3f65621155cd
/opt/CAPEv2/storage/analyses/14288/files/5ff366f40e9e60e5c81b21e3bae9f6e817fb40725887763a2fc9431368942f61 - 5ff366f40e9e60e5c81b21e3bae9f6e817fb40725887763a2fc9431368942f61
/opt/CAPEv2/storage/analyses/14288/files/070f2c6900e1385bb0cf32eacf4a2c1f4957c9221c96e90db0916ead8de2c9fa - 070f2c6900e1385bb0cf32eacf4a2c1f4957c9221c96e90db0916ead8de2c9fa
/opt/CAPEv2/storage/analyses/14288/files/d500022e358d7d547c1b21a02f7099ea4e4108a882077b78fccef9434eec9655 - d500022e358d7d547c1b21a02f7099ea4e4108a882077b78fccef9434eec9655
/opt/CAPEv2/storage/analyses/14288/files/167fe7fed915a39a92c9f995635f14078d61db8380d0aacb7adb84b4fa4d067a - 167fe7fed915a39a92c9f995635f14078d61db8380d0aacb7adb84b4fa4d067a
/opt/CAPEv2/storage/analyses/14288/files/506f8997f31ef01b75959ba9237c1de9327be759b1b37188039e2fb4be4a95d7 - 506f8997f31ef01b75959ba9237c1de9327be759b1b37188039e2fb4be4a95d7

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786570826&P2=404&P3=2&P4=V%2fPLSjA%2fHG3KO42wfH4BhdIZsB2iH79THYhBW4Pv4J0xL6eep4MFfryz9yCSeVWnWbCFBYe9OqqqZnMjvWqHmg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786570905&P2=404&P3=2&P4=hvvYlPDDV0pZJ6l1Lpf5PsT%2f7ewRIeuUbgQhRX0Iv5cv4XLO837QeKQSPIALsmLfsnenw%2bTplBlwf1SVhFuPxw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

nwoccs.zapto.org

Embedded IP addresses

20.184.175.7
52.123.252.202
20.247.184.142
4.230.171.124
172.215.188.225
74.178.76.128
74.179.77.164
52.168.117.169
135.233.45.221
92.223.78.30
135.234.160.246
135.233.45.222
203.26.79.13
135.233.95.80
72.145.35.114
52.148.114.188
52.110.12.10
52.110.12.1

File paths

H:\:p:

More Gamaredon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report