MALICIOUS — 6c2f106594d0074d030911d67142ba59c8856ec7e98ec110077ef80c506a0102

MALICIOUS — 6c2f106594d0074d030911d67142ba59c8856ec7e98ec110077ef80c506a0102 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100). 2 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 6c2f106594d0074d030911d67142ba59c8856ec7e98ec110077ef80c506a0102
• SHA-1: bd1d681f63da6a0448cdbc9945df21a2c8cea678
• MD5: 6adbc3562ffca6761a5fa816372488fa
• imphash: 5e6955ab958f0427686406bc5d4d6248
• ssdeep: 49152:sEFMFnmP36BxNe/k3m4nPMW3DtZBfxDYszAcbIUlDQqQU:RP36DX3m4nPMWTvDYszLbIUlD7n
• TLSH: T184585C8D023FA703D3B6CB642C189EAE4071B0D935BDB59C3A47613F65A34A39D31269
• Submitted as: 6c2f106594d0074d030911d67142ba59c8856ec7e98ec110077ef80c506a0102
• File type: pe · Size: 1647848 bytes
• Verdict: malicious (97/100)

Detections (2 of 56 engines)

• ClamAV (daily): Win.Malware.Genpack-9875426-0
• Microsoft Defender: flagged

MITRE ATT&CK

• T1547.001
• T1071.001

Why this verdict

The malicious score of 97/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Win.Malware.Genpack-9875426-0 (rule Win.Malware.Genpack-9875426-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
• Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: http://www.gnu.org/licenses/, http://www.gnu.org/software/coreutils/, http://translationproject.org/team/ - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• licensing.mp.microsoft.com
• windows.msn.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• www.bing.com
• assets.msn.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• www.msftconnecttest.com/connecttest.txt

Embedded URLs

• http://www.gnu.org/licenses/
• http://www.gnu.org/software/coreutils/
• http://translationproject.org/team/
• http://gnu.org/licenses/gpl.html
• http://www.gnu.org/gethelp/
• http://schemas.microsoft.com/windows/2009/library
• http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
• http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
• http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
• http://office.microsoft.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• cwru.edu
• gnu.org
• www.gnu.org
• translationproject.org
• cygwin.com
• schemas.microsoft.com
• crl.microsoft.com
• www.microsoft.com
• office.microsoft.com
• command.com

Embedded IP addresses

• 4.150.223.98
• 20.247.185.124
• 4.230.171.124
• 52.110.12.15
• 52.110.12.21

Registry keys

• HKEY_LOCAL_MACHINE\%s.

File paths

• C:\Users\a.monaldo\Desktop
• P:\Target\x86\ship\msicustomactions\x-none\diagnoseca.pdb
• P:\Target\x86\ship\msicustomactions\x-none\abortmsica.pdb
• P:\Target\x86\ship\msicustomactions\x-none\patchca.pdb
• J:\:f:l:
• P:\Target\x86\ship\msicustomactions\x-none\rmaddlocalca.pdb
• X:\:
• P:\Target\x86\ship\msicustomactions\x-none\ocfxca.pdb
• D:\:l:p:
• R:\:f:p:z:
• D:\:
• P:\Target\x86\ship\msicustomactions\x-none\mainca.pdb
• P:\:d:
• X:\:`:d:h:l:p:t:x:
• P:\Target\x86\ship\clview\x-none\mshelp\defhh20.pdb
• P:\Target\x86\ship\clview\x-none\mshelp\reghh20.pdb
• C:\Users\Public\Libraries\desktop.ini
• C:\Users\a.monaldo\Favorites\Links
• C:\Users\a.monaldo\Favorites\Links\desktop.ini

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report