MALICIOUS — 6e141c5197bfe7adaaffc6b703b07689bebddff3e5ac3f450dd340059a40322b
MALICIOUS — 6e141c5197bfe7adaaffc6b703b07689bebddff3e5ac3f450dd340059a40322b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Vtflooder family. 8 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
6e141c5197bfe7adaaffc6b703b07689bebddff3e5ac3f450dd340059a40322b - SHA-1:
aa27b8d22f1261b2201b72fa0cf224ab3a440639 - MD5:
be50efb99c01106de80a113cd104680d - imphash:
8c9bb9d690553503983713582e1e58f7 - ssdeep:
96:Mv110GxW2FjJYPmVI+V9IGjSJGs+K1C+Rv2aKb43dkU:Mv110GPdYPmVI+UGj8C+RPj3dkU - TLSH:
T1D01B6C676B21895CD9DD18E82748A2CDD6A24D2F28348E6019319037647C17F7BFB10C - Submitted as: 6e141c5197bfe7adaaffc6b703b07689bebddff3e5ac3f450dd340059a40322b
- File type: pe · Size: 5120 bytes
- Verdict: malicious (98/100) · Family: Vtflooder
Detections (8 of 55 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Vtflooder-6722904-1
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Detect It Easy (packer/type): DIE:Microsoft Linker
- Microsoft Defender: Trojan:Win32/Vflooder
- Emsisoft (Emergency Kit): Gen:Variant.Razy.482569
- Trellix Stinger (McAfee): Generic-FAVK!BE50EFB99C01
- Kaspersky (KVRT): Trojan.Win32.Vtflooder.cft
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 8 weighted signals:
- ClamAV (daily) flagged Win.Malware.Vtflooder-6722904-1 (rule
Win.Malware.Vtflooder-6722904-1) - engine signal, weight 0.90, confidence 0.95 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 27 external host(s) at runtime (28 HTTP) - network signal, weight 0.40, confidence 0.80
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule
DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
13020 behavior events · 2 ATT&CK techniques · 2 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- twitter.com
- www.virustotal.com
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- config.edge.skype.com
- v20.events.data.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
Dropped files
- de45b4814fdf383c1f7b751cae0be49e088892236c06df48a3d54b756ac5bedc -
de45b4814fdf383c1f7b751cae0be49e088892236c06df48a3d54b756ac5bedc - 2ed511cc51ba71b98d15aa84c73929111c5e5d92cb81c2c29697e0a101f696c6 -
2ed511cc51ba71b98d15aa84c73929111c5e5d92cb81c2c29697e0a101f696c6
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://twitter.com/pidoras6
- http://www.virustotal.com/vtapi/v2/file/scan
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787791570&P2=404&P3=2&P4=dkWQEgB%2bL8n%2fuclsyTYVA8tmbOZG5il7MJqDr9cyJr60ECiD%2fCofZ%2bnUK2XwocpTXGU6cVSSlXRwsiI%2fjuQ9TQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787791619&P2=404&P3=2&P4=HL8xB4jUUBJWf%2bk3amyZ%2faDKkPrnZ8wboCWdCnRvy2lYHJI2HbogjqHh28jj%2bfjZsBSCLzBWY9y0%2fpnvzhp1Xw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787188303&P2=404&P3=2&P4=ee2uCn0RlXKda2jtKsndhdJEwFptguHz4kPz4MsxjcBitw7mtg4ENlJ20nIQ%2bTkBFaechMf2xp6K40fuDo821g%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787187827&P2=404&P3=2&P4=XW7qL4NylmF%2bT7kEFfiF9TvYezXsOfaxD0E%2baXkpYt%2fh7kXAsGLF5ceXkV5Vl8hYCTa4kfJNQbg1mwhtzU06Cg%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- www.virustotal.com
Embedded IP addresses
- 52.123.252.247
- 4.150.223.106
- 20.247.185.124
- 4.230.171.124
- 4.247.188.233
- 135.233.95.144
- 20.165.94.54
- 20.42.65.93
- 52.123.129.14
- 20.231.239.246
- 40.103.64.242
- 52.123.128.14
- 20.42.73.28
- 172.178.240.163
- 34.54.88.138
- 74.178.76.44
- 203.26.79.13
- 52.148.114.188
- 52.110.12.15
- 52.110.12.14
- 52.123.252.216
- 48.192.143.121
- 20.42.73.27
- 72.145.35.100
- 52.110.12.28
More Vtflooder samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report