MALICIOUS — 6c95d056e21f7a91a19ad6df52d77812d90c61347ce3829cb170440658bd4ec9

MALICIOUS — 6c95d056e21f7a91a19ad6df52d77812d90c61347ce3829cb170440658bd4ec9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AB9A06E4 family. 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 6c95d056e21f7a91a19ad6df52d77812d90c61347ce3829cb170440658bd4ec9
SHA-1: f6845da997489f6af2911e0f35f0bd3de271b2b0
MD5: f81fca5d4ea5312eaec1503d9c9f029d
imphash: 532816589b7c9c3bed0fbcc3d1503ba1
ssdeep: 3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/e8JtkaZgxkapK:o68i3odBiTl2+TCU/ftkqAhuhuIpRLJ
TLSH: T1F9447EBE0B177B02D172C7681D095E9F0032B4DEA13D68CC5A63902E57FAC27B64859B
Submitted as: 6c95d056e21f7a91a19ad6df52d77812d90c61347ce3829cb170440658bd4ec9
File type: pe · Size: 248470 bytes
Verdict: malicious (100/100) · Family: AB9A06E4

Detections (6 of 56 engines)

ClamAV (daily): Win.Worm.Nupik-1
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
Microsoft Defender: Worm:Win32/Delf.BE!MTB
Emsisoft (Emergency Kit): Dropped:Generic.Malware.SV!p2p!u.AB9A06E4
Kaspersky (KVRT): P2P-Worm.Win32.VB.dz

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 17 weighted signals:

ClamAV (daily) flagged Win.Worm.Nupik-1 (rule Win.Worm.Nupik-1) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Worm:Win32/Delf.BE!MTB (rule Worm:Win32/Delf.BE!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dropped:Generic.Malware.SV!p2p!u.AB9A06E4 (rule Dropped:Generic.Malware.SV!p2p!u.AB9A06E4) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged P2P-Worm.Win32.VB.dz (rule P2P-Worm.Win32.VB.dz) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Dropped a suspicious payload: BalROK.HTML - dynamic signal, weight 0.40, confidence 0.90
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: 3.6.1.0, 5.0.3.6 - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

11005 behavior events · 3 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Windows\SHARE_TEMP\Icon12.ico - 67bc1cd876f5059789b0dc8dc16c0b2155e55aca8d1c8439d70c8882e1875740
C:\Windows\bugMAKER.bat - ca1c342366cea68c002ff874c4ee72e87032b7efbf6900097d21deac9193385d
C:\BalROK.HTML - 3959c5532031a58119c317dda15ac9313505df4a92c004cd2e76b071b0fad4a4
C:\Windows\SHARE_TEMP\Icon6.ico - 0df5c718b7aee9f045f804f6a53cb0727f66e1ac1df612c6ecf342aed81ce130
C:\Windows\SHARE_TEMP\Icon2.ico - 00a339ff5338d0cfe91b262175eef4e5fd07f9d28e8f980a1f5ff43a5a81e597
C:\Windows\SHARE_TEMP\Icon7.ico - 71acc5a88debfdba0eed23272ef4b09fd6609eeb4b1ec457c72444472ad8b3a4
C:\Windows\SHARE_TEMP\Icon3.ico - d2770f68db717c5335ceca3f2b0be1e294839a4904d3525f4c5e9847654d39c2
C:\Windows\SHARE_TEMP\Icon14.ico - adb0b5eb4fcfcc55c40eaa2ba3d142ed413293b2212bb2a1ddd8ed062db004bf
C:\Windows\winhash_up.exe - c1cf04bceeabbd30ac6a195f03c9aa9fefb15b012b410a0262fe9db84d925f60
C:\Windows\SHARE_TEMP\Icon10.ico - 76f05dd79b2d3a08baf928e4811b0f179e96ac351ff8007f2e24f5fbb4b95253
C:\Windows\SHARE_TEMP\Icon5.ico - 462d333fc849166df8cb4e9ba6edd8404f4d79ebcd535125ecb5e8fe9d2cc0e0

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

3.6.1.0
5.0.3.6
20.184.175.14
52.123.252.225
4.230.171.124
20.247.184.142
57.154.63.210
135.232.92.137
40.79.163.155
135.232.92.97
20.42.65.94
172.66.2.5
52.110.12.11
52.110.12.24
135.233.45.222
48.211.4.16
125.56.205.24
125.56.205.17
72.154.7.113
52.110.12.10
52.148.114.188
52.110.12.54

File paths

C:\Programme\eMule

More AB9A06E4 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report