MALICIOUS — 736_WMIGhost.bin

MALICIOUS — 736_WMIGhost.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Syndicasec family. 5 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 7249b1a5082c9d9654d9fac3bb5e965ea23e395554d3351b77dd4f29677426fe
• SHA-1: eb25fb0fdd8a7c4347718f476be1a36725f3f3b9
• MD5: 71661cb05ac3beef85615bdecc5b3ede
• imphash: f348a7b24c65bb3640be89e8c9e1268e
• ssdeep: 384:183cpDeJ0F0mmoc51Gxithcevm5rBEM4ITDX6hcrpqjHc:axwZmoAGIzQB0ITDX6hcrpqjHc
• TLSH: T1152A2A696B011C64ED87DF82C550CE5E2AA39F34156B848C02E1CB9F8364C939869AFD
• Submitted as: 736_WMIGhost.bin
• File type: pe · Size: 20480 bytes
• Verdict: malicious (99/100) · Family: Syndicasec

Detections (5 of 51 engines)

• ClamAV (daily): {MD5}bin.trojan.syndicasec.9303.UNOFFICIAL
• Microsoft Defender: Trojan:Win32/Syndicasec
• Emsisoft (Emergency Kit): Gen:Variant.Fugrafa.114848
• Trellix Stinger (McAfee): Trojan-Thrip!71661CB05AC3
• Kaspersky (KVRT): Trojan.Win32.Agentb.bmva

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 99/100 is the fusion of 6 weighted signals:

• ClamAV (daily) flagged {MD5}bin.trojan.syndicasec.9303.UNOFFICIAL (rule {MD5}bin.trojan.syndicasec.9303.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/Syndicasec (rule Trojan:Win32/Syndicasec) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Fugrafa.114848 (rule Gen:Variant.Fugrafa.114848) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Trojan-Thrip!71661CB05AC3 (rule Trojan-Thrip!71661CB05AC3) - engine signal, weight 0.55, confidence 0.85
• Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

1475 behavior events · 1 ATT&CK techniques · 1 dropped files.

Runtime network

• none

Dropped files

• /opt/CAPEv2/storage/analyses/6349/files/bb582bb9292faf3b9d17a4de6dd33cb57613a59e1bf1044463f7689c39dd6cee - bb582bb9292faf3b9d17a4de6dd33cb57613a59e1bf1044463f7689c39dd6cee

File paths

• C:\e1d852f2ea8436ac33bc8fe200aca4af4fb15f33ecda6441741589daa44115c5

More Syndicasec samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report