MALICIOUS — 115_EarthKrahang_20240404.bin

MALICIOUS — 115_EarthKrahang_20240404.bin is a lnk sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the GenericFCA family. 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 6d03c6b7621990f84580eaa094393fbf896803c86779644506b115692b70bd64
• SHA-1: b5d8c23d4e8881ecf18ce5a59f17201c14a9c1b0
• MD5: 4e46218da434ed4da24dc086f6262c27
• ssdeep: 12:8+VNcmI2dIXL0ec7U88lC6nlHc6y77sHjEjAgGD0sbpZMKFZXr5BFZXL:8+zXISFV8lbnlc6ooHUAD0YHM0z
• TLSH: T16910C0C9B80A635DDB5B440C670819DC5497F0EA3439776C094CC56505A9F276CBA605
• Submitted as: 115_EarthKrahang_20240404.bin
• File type: lnk · Size: 672 bytes
• Verdict: malicious (97/100) · Family: GenericFCA

Detections (2 of 50 engines)

• ClamAV (daily): {MD5}data.loader.xdealer.9401.UNOFFICIAL
• Emsisoft (Emergency Kit): Trojan.GenericFCA.Agent.118650

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 97/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged {MD5}data.loader.xdealer.9401.UNOFFICIAL (rule {MD5}data.loader.xdealer.9401.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Memory forensics: 3 finding(s), e.g. RWX/private injected region in svchost.exe (pid 924) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.GenericFCA.Agent.118650 (rule Trojan.GenericFCA.Agent.118650) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

7434 behavior events · 1 ATT&CK techniques · 3 dropped files.

Runtime network

• none

Dropped files

• /opt/CAPEv2/storage/analyses/5926/files/619bc206f20a479157e3e3cd9d5b33e08e6ca59ae1923f13d8170466d4bff679 - 619bc206f20a479157e3e3cd9d5b33e08e6ca59ae1923f13d8170466d4bff679
• /opt/CAPEv2/storage/analyses/5926/files/7b2b75dcd466aeae1864aa3bc86f03ee3598f322a2e15895f125ebd4170f7020 - 7b2b75dcd466aeae1864aa3bc86f03ee3598f322a2e15895f125ebd4170f7020
• /opt/CAPEv2/storage/analyses/5926/files/6e70fe984d522d27e532804e62da72cd747f8597b7d55f5596bc7f4c47ec1e69 - 6e70fe984d522d27e532804e62da72cd747f8597b7d55f5596bc7f4c47ec1e69

File paths

• C:\ProgramData\GoogleInc\kvsvrhost.exe
• C:\ProgramData\GoogleInc`

More GenericFCA samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report