MALICIOUS — 605_Skywiper-A.Flame.bin

MALICIOUS — 605_Skywiper-A.Flame.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Flame family. 8 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 69beb78c8b8de1a86677e27c531c92cb5ca70807d2755b94f70a75887fbc90cf
• SHA-1: 60d5dbddae21ecb4cfb601a2586dae776ca973ef
• MD5: bb5441af1e1741fca600e9c433cb1550
• imphash: 3aeffff1a896499847d0e973226a7948
• ssdeep: 6144:cbDGluUNKp0af7G/YF94KzCHsgaJP8r1fwk8lH65HIAUY32s38hDoLCsGyRwFU1:2GjNSsG4awoJP+v26bV2s3hLRwFn
• TLSH: T1934E5B143642B693EA3D639C3C708E5D7072B4C636B8F57DBBA2518E92E7B53A045230
• Submitted as: 605_Skywiper-A.Flame.bin
• File type: pe · Size: 643072 bytes
• Verdict: malicious (100/100) · Family: Flame

Detections (8 of 52 engines)

• ClamAV (daily): Win.Worm.Flame-6
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Cyble Vision: Cyble Vision: MaliciousURLs
• Microsoft Defender: Worm:Win32/Flame.gen!B
• Emsisoft (Emergency Kit): Gen:Variant.Worm.Flamer.6
• Trellix Stinger (McAfee): SkyWiper
• Kaspersky (KVRT): Worm.Win32.Flame.a

MITRE ATT&CK

• T1057
• T1112

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

• ClamAV (daily) flagged Win.Worm.Flame-6 (rule Win.Worm.Flame-6) - engine signal, weight 0.90, confidence 0.95
• Cyble Vision flagged Cyble Vision: MaliciousURLs (rule Cyble Vision: MaliciousURLs) - engine signal, weight 0.90, confidence 0.95
• Memory forensics: 4 finding(s), e.g. RWX/private injected region in sppsvc.exe (pid 9048) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Microsoft Defender flagged Worm:Win32/Flame.gen!B (rule Worm:Win32/Flame.gen!B) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Worm.Flamer.6 (rule Gen:Variant.Worm.Flamer.6) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged SkyWiper (rule SkyWiper) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Worm.Win32.Flame.a (rule Worm.Win32.Flame.a) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

109 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• none

File paths

• E:\:f:
• P:\:f:r:~:
• X:\:`:d:h:l:p:t:x:
• X:\:`:x:
• D:\:h:
• P:\:
• T:\:d:p:

More Flame samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report