MALICIOUS — 72143020beba624836f2f483ff2d9b9c9cc983e6220a980150d33ad7f07c173b

MALICIOUS — 72143020beba624836f2f483ff2d9b9c9cc983e6220a980150d33ad7f07c173b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Barys family. 7 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 72143020beba624836f2f483ff2d9b9c9cc983e6220a980150d33ad7f07c173b
SHA-1: f0ed4d117c4e6f112c6c4079dd734ed9101e5f55
MD5: b8625ccb256e957991263a1aba136474
imphash: ac9eb1085b6eee2907a6ad89926cf94d
ssdeep: 768:97Vcddp9Nkcy1roWSUDBtVa4uvTwnGr/FkvN:9odJctowDfVa4krrN2N
TLSH: T1BC2EE1AD86DD3EFFC2F15B463081987C48004C59237B2A64A152C56EC4E567FE8EF288
Submitted as: 72143020beba624836f2f483ff2d9b9c9cc983e6220a980150d33ad7f07c173b
File type: pe · Size: 31472 bytes
Verdict: malicious (100/100) · Family: Barys

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:CODE
ClamAV (daily): Win.Malware.Barys-9916803-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Variant.Stealer.210
Kaspersky (KVRT): HEUR:Trojan-Downloader.Win32.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Barys-9916803-0 (rule Win.Malware.Barys-9916803-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Vindor!pz (rule Trojan:Win32/Vindor!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Stealer.210 (rule Gen:Variant.Stealer.210) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.Win32.Agent.gen (rule HEUR:Trojan-Downloader.Win32.Agent.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 13 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:CODE (rule high-entropy-sections:CODE) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:CODE, Turbo Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

15652 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

bf057e5211d29c67977f8f3767c559c0770309de6274c12c18dc901eac40bf77 - bf057e5211d29c67977f8f3767c559c0770309de6274c12c18dc901eac40bf77

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

schemas.microsoft.com
zb.netba8.com

Embedded IP addresses

20.52.64.201
52.123.252.203
40.84.85.40
4.230.171.124
52.230.60.54
4.247.188.224
135.232.92.97
135.232.92.137
4.150.223.102
104.18.33.89
20.165.94.63
4.237.188.71
52.123.252.195
52.110.12.15
52.110.12.20
172.178.240.163
172.178.240.161
20.184.175.1
13.69.116.108
135.234.160.246
72.145.35.110
52.148.114.188
52.110.12.16

More Barys samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report