MALICIOUS — 6bdb9aec3fc52e30229ecf877aec60877f7175f14fb9ad864e71b3f9567e7790

MALICIOUS — 6bdb9aec3fc52e30229ecf877aec60877f7175f14fb9ad864e71b3f9567e7790 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100), attributed to the CosmicDuke family. 5 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 6bdb9aec3fc52e30229ecf877aec60877f7175f14fb9ad864e71b3f9567e7790
SHA-1: 70555bf07bfa0cc9f4a070234ecf85f4d794293c
MD5: dc2a6ade0939fac3b9a174ee421d7310
imphash: 295b9b51053034742966a3ab9205b1cd
ssdeep: 12288:KGqG0TnCNY+dK2mhAMJ/cPlEO7c8zcyLxODStGtR3ZX:KG6TCNs2O/GlP4yRCS+R3ZX
TLSH: T10E4CE19D5115A745E6B3EF606C105D1CA1A7F4EA20BE386D06C3C02E33E3E6FA675148
Submitted as: 6bdb9aec3fc52e30229ecf877aec60877f7175f14fb9ad864e71b3f9567e7790
File type: pe · Size: 542720 bytes
Verdict: malicious (88/100) · Family: CosmicDuke

Detections (5 of 55 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/Conteban.A!ml
Emsisoft (Emergency Kit): Gen:Variant.Zusy.406898
Kaspersky (KVRT): VHO:Backdoor.Win32.CosmicDuke.gen

MITRE ATT&CK

T1055

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 88/100 is the fusion of 4 weighted signals:

Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Contacted 22 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis (windows)

33 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787939157&P2=404&P3=2&P4=hiG5JwhrnD5F95Th6KhBPCX5L9NKHJwOM9X%2fmZC3f9KbFThpyeVxhgwCt4g9iziFQuwkf7Zrg3nxkITZrwYdtQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787939185&P2=404&P3=2&P4=MALtur%2fr80NxLvblAVzA6fcs3pl6WywNsP1PTIrd%2f2vv4VFS2sFCK%2bP1P57FtjJXuJJk%2by8egtkp5xlt3Kay9A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

52.168.117.174
20.42.179.204
52.230.60.54
4.230.171.124
20.165.94.63
74.179.77.164
20.42.73.24
74.178.76.44
203.26.79.13
20.76.201.171
52.123.128.14
52.123.129.14
4.150.223.114
135.233.45.222
92.223.78.30
85.210.196.11
52.110.12.42
52.110.12.53
52.148.114.188
72.154.7.113
52.110.12.50
52.110.12.3

File paths

C:\Users\ubuntu\Desktop\project\hyphernate_proc_exe\Typical
d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
T:\:a:g:o:t:z:
T:\:d:l:t:

More CosmicDuke samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report