MALICIOUS — 7272103448b276dd7a3cd3d5bc3d1070e81c7d36c6efdc2dd13f40e6ddc65177

MALICIOUS — 7272103448b276dd7a3cd3d5bc3d1070e81c7d36c6efdc2dd13f40e6ddc65177 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the OnlineGames family. 8 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 7272103448b276dd7a3cd3d5bc3d1070e81c7d36c6efdc2dd13f40e6ddc65177
SHA-1: f6538d96cfd47e4e701b3111f8189be46c6e3858
MD5: 0783dbee854b0efb47907980300c4579
imphash: cce36a11c37a3e0eae784a8607f3a9b4
ssdeep: 6144:+FxTaDaBrX99L162Y4SVFH34Ya2EpQ01S1Nx8KDkc+m+t8jpt:+FxTaD+X9pJYhN34YaTj1sNmgkC+t8j
TLSH: T1C8494B5828136D4DCAA6E5702CE89F0DE8B276AD16BA09C6438FC7FF539FC175026085
Submitted as: 7272103448b276dd7a3cd3d5bc3d1070e81c7d36c6efdc2dd13f40e6ddc65177
File type: pe · Size: 415340 bytes
Verdict: malicious (98/100) · Family: OnlineGames

Detections (8 of 55 engines)

capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
ClamAV (daily): Win.Trojan.OnlineGames-65
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/BHO!pz
Trellix Stinger (McAfee): Trojan-FUHM!0783DBEE854B
Kaspersky (KVRT): Trojan-Downloader.Win32.Gamup.qdn

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Trojan.OnlineGames-65 (rule Win.Trojan.OnlineGames-65) - engine signal, weight 0.90, confidence 0.95
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 26 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://stat.wamme.cn/C8C/gl/cnzz60.html?page=http://www.WebDllx.com/NewRun, http://stat.wamme.cn/C8C/gl/cnzz60.html?page=http://www.WebDllx.com/NoDllx, http://stat.wamme.cn/C8C/gl/cnzz61.html?page=http://www.WebDllx.com/RunExeFail - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1064 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Program Files\accordingly\Panel.exe - 8997de74e09817a737f691e44cf6dd3664473b75f7723039ee4a67c3bf291396

Embedded URLs

http://stat.wamme.cn/C8C/gl/cnzz60.html?page=http://www.WebDllx.com/NewRun
http://stat.wamme.cn/C8C/gl/cnzz60.html?page=http://www.WebDllx.com/NoDllx
http://stat.wamme.cn/C8C/gl/cnzz61.html?page=http://www.WebDllx.com/RunExeFail
http://www.baiduo.org/
http://i.maxthon.cn/
http://stat.wamme.cn/C8C/gl/cnzz60.html
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787755966&P2=404&P3=2&P4=eZzQf9%2f55OM50%2bZ%2bZlfbS093btjH7Yyo2FH31K%2bpQxORPdXUt3Mii8hNri1LNGzrRUszHvbxykf9fZlqJIOVKQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787756050&P2=404&P3=2&P4=Q0RUMl1eOzpQnpBHnGqhLseJwjeJk8KidmYiO2v09MTruiqLANxeakDTIcR4b8wYnSwavIlnHVZ4LPbLLNQnPA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

stat.wamme.cn
2345.com
www.baiduo.org
i.maxthon.cn

Embedded IP addresses

20.165.94.46
20.42.65.88
52.123.252.227
48.211.4.16
4.230.171.124
20.3.0.251
74.178.240.61
135.233.95.135
51.116.253.170
52.110.12.31
52.110.12.40
20.50.201.200
20.231.239.246
52.123.129.14
40.104.4.2
52.123.128.14
172.178.240.161
85.210.193.152
40.84.85.40
203.26.79.13
52.148.114.188
135.232.92.34
92.223.78.30
72.153.5.61
52.110.12.48

File paths

C:\WINDOWS\system32\drivers\etc\service5.ini
C:\Program
c:\windows\KB978978.log
C:\WINDOWS\system\sdax.txt
e:\JinZQ\Hook
C:\WINDOWS\system32\drivers\etc\service3.ini

More OnlineGames samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report