MALICIOUS — 6eaa3aba684a1934580255301f117abe8fb0ba591519ea6931cd13d2fac4c8da

MALICIOUS — 6eaa3aba684a1934580255301f117abe8fb0ba591519ea6931cd13d2fac4c8da is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Autoit family. 11 of 52 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

• SHA-256: 6eaa3aba684a1934580255301f117abe8fb0ba591519ea6931cd13d2fac4c8da
• SHA-1: 04b2cf8b67ae153f971c8e56f9ad9b695cfcbe1d
• MD5: 10e34fe0accddcc2a484d08537d5e375
• imphash: 3c10d2aa2614755ccdb513472bf0a6a1
• ssdeep: 98304:uKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUl+LZ1opDbSVHrjt62UT:uquFIF0wuPlCKrjReLZ7pj4fT
• TLSH: T16B6D9E89471B2317F2F2CD547C50999C8466B0ED21B87A8D0783C57FA0E6937ECB11AA
• Submitted as: 6eaa3aba684a1934580255301f117abe8fb0ba591519ea6931cd13d2fac4c8da
• File type: pe · Size: 12018880 bytes
• Verdict: malicious (100/100) · Family: Autoit

Detections (11 of 52 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• capa (capabilities): capability:collection/keylog
• ClamAV (daily): Win.Packed.Autoit-7640561-0
• YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
• YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Microsoft Defender: Trojan:Win64/Zusy.PGZI!MTB
• Emsisoft (Emergency Kit): Gen:Variant.Tedy.943772
• Kaspersky (KVRT): Virus.Win64.Lamer.a

MITRE ATT&CK

• T1547.001
• T1071.001
• T1486
• T1057
• T1056.001
• T1055

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

• ClamAV (daily) flagged Win.Packed.Autoit-7640561-0 (rule Win.Packed.Autoit-7640561-0) - engine signal, weight 0.90, confidence 0.95
• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• Microsoft Defender flagged Trojan:Win64/Zusy.PGZI!MTB (rule Trojan:Win64/Zusy.PGZI!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Tedy.943772 (rule Gen:Variant.Tedy.943772) - engine signal, weight 0.55, confidence 0.85
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: http://www.tutorialspoint.com/javascript/array_map.htm, http://es5.github.io/#x15.4.4.21, http://stackoverflow.com/a/15123777 - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
• encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
• http://www.microsoft.com/windows0
• https://sjremetrics.java.com/b/ss//6
• https://java.com
• https://javadl-esd-secure.oracle.com/update/1.8.0/8c876547113c4e4aab3c868e9e0ec572/1.8.0_381-b09.xml
• https://java.com/verify9/?src=install
• https://www.java.com/applet/javaLatestVersion.xml
• http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd
• http://www.w3.org/1999/xhtml
• https://java.com/data/
• https://java.com/otnlicense/
• http://www.tutorialspoint.com/javascript/array_map.htm
• https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/filter
• https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/indexOf
• https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/Reduce
• http://es5.github.io/#x15.4.4.21
• https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/startsWith
• https://developer.mozilla.org/en/docs/Web/JavaScript/Reference/Global_Objects/String/endsWith
• https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/Trim
• http://stackoverflow.com/a/15123777
• http://stackoverflow.com/questions/1026069/capitalize-the-first-letter-of-string-in-javascript
• http://stackoverflow.com/questions/1068834/object-comparison-in-javascript
• http://www.computerhope.com/forum/index.php?topic=76293.0
• http://stackoverflow.com/a/1465386/4224163

Embedded domains

• www.microsoft.com
• crl.microsoft.com
• sjremetrics.java.com
• javadl-esd-secure.oracle.com
• mozilla.org
• www.java.com
• oraclevcn.com
• oracle.com
• www.w3.org
• www.tutorialspoint.com
• developer.mozilla.org
• es5.github.io
• stackoverflow.com
• e.name
• www.computerhope.com
• info.name
• ns.adobe.com
• schemas.microsoft.com
• www.oracle.com
• purl.org
• gg.uk
• cacerts.digicert.com
• crl3.digicert.com
• crl4.digicert.com
• www.digicert.com

Embedded IP addresses

• 15.4.4.21
• 6.0.1.0
• 1.9.15.1
• 1.9.16.3
• 1.101.3.4
• 1.1.0.14
• 6.0.6.0
• 3.14.150.0

Registry keys

• HKCU\\Software\\O&O\\O&O

File paths

• C:\Users\Vinay\Projects\simple_launcher\dist\w64.pdb
• T:\:c:
• X:\:`:d:h:l:p:t:x:
• c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\install\src\windows\common\Dll.h
• c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\install\src\windows\wrappers\common\UpdateUtils.hpp
• c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\install\src\windows\common\MsiUtils.h
• c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\install\src\windows\common\InstalledJavaTracker.h
• C:\\jenkins\\workspace\\8-2-build-windows-i586-cygwin-sans-NAS\\jdk8u381\\237\\install\\make\\smartmake\\scripting\\util.js
• C:\\jenkins\\workspace\\8-2-build-windows-i586-cygwin-sans-NAS\\jdk8u381\\237\\install\\make\\smartmake\\scripting\\Arrays.js
• C:\\jenkins\\workspace\\8-2-build-windows-i586-cygwin-sans-NAS\\jdk8u381\\237\\install\\make\\smartmake\\scripting\\log.js
• C:\\jenkins\\workspace\\8-2-build-windows-i586-cygwin-sans-NAS\\jdk8u381\\237\\install\\make\\smartmake\\scripting\\activex.js
• C:\\jenkins\\workspace\\8-2-build-windows-i586-cygwin-sans-NAS\\jdk8u381\\237\\install\\make\\smartmake\\scripting\\deepCompare.js
• C:\\jenkins\\workspace\\8-2-build-windows-i586-cygwin-sans-NAS\\jdk8u381\\237\\install\\make\\smartmake\\scripting\\Assert.js
• C:\\jenkins\\workspace\\8-2-build-windows-i586-cygwin-sans-NAS\\jdk8u381\\237\\install\\make\\smartmake\\scripting\\Filename.js
• c:\Program
• I:\:f:
• J:\:
• L:\:`:d:h:p:
• L:\:`:p:t:x:
• X:\:d:
• D:\:d:l:t:
• P:\:
• L:\:h:p:
• T:\:d:l:x:
• X:\:`:H;L;P;T;X;\;`;d;h;l;p;X

More Autoit samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report