MALICIOUS — 6be615706523d4dfe5092625728759f303866869b09e4af4f73b126e6737ce7c

MALICIOUS — 6be615706523d4dfe5092625728759f303866869b09e4af4f73b126e6737ce7c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Philis family. 6 of 56 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: 6be615706523d4dfe5092625728759f303866869b09e4af4f73b126e6737ce7c
SHA-1: 284ef797dcf30ce670f5dfbc03097debbaf996c7
MD5: dc63dde5159bec385b051d1fb5cb878a
imphash: 2fab63f5a4a28536b1b3d87dbadc944c
ssdeep: 3072:ZKSkQOueDKHPamHd6xr2NvGz7Q3Yg3TsA:EQOuVaQd/vWa3TsA
TLSH: T10B3E4A3E1F272A8FE676C3457C902A6C4472F4F9607A4448A397C0ADA7EBC534661329
Submitted as: 6be615706523d4dfe5092625728759f303866869b09e4af4f73b126e6737ce7c
File type: pe · Size: 144896 bytes
Verdict: malicious (100/100) · Family: Philis

Detections (6 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Philis-159
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Viking.KQ
Emsisoft (Emergency Kit): Dropped:Generic.Viking.1ABD9CF3
Kaspersky (KVRT): Worm.Win32.Viking.bi

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Trojan.Philis-159 (rule Win.Trojan.Philis-159) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.KQ (rule Virus:Win32/Viking.KQ) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dropped:Generic.Viking.1ABD9CF3 (rule Dropped:Generic.Viking.1ABD9CF3) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.Viking.bi (rule Worm.Win32.Viking.bi) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
2 behavioral detection(s) across 2 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.43, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

2166 behavior events · 1 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\tsk_2b2a3b65dbc040fe.exe.exe - 8085c1515b40079751a2c0bd20e56350a4e25a6727b0125a4301ffeb135ce3e5
C:\Windows\Logo1_.exe - e2ce17aa74280458364281619fd02156d78e0515872b6d2d879b2ef4dde81df5
C:\Users\analyst\AppData\Local\Temp\$$aDB7B.bat - c6ee9dd2788367cbaf58301224ee078488c6fe0bbc10f3d9e21ed46ecc8144ea

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

52.182.143.212
52.123.252.245
4.230.171.124
40.84.85.40
4.144.132.223
74.178.240.51
20.165.94.63
20.42.72.131
20.184.175.20
52.110.12.30
52.110.12.26

File paths

C:\Jenkins\jobs\miktex-2.9\workspace\build-x86\binlib\miktex-makepk.pdb

More Philis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report