MALICIOUS — 728165ae7edfe342abfac697c54852e14128f1d052ae42b7fa22a39b9b27ee68

MALICIOUS — 728165ae7edfe342abfac697c54852e14128f1d052ae42b7fa22a39b9b27ee68 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the ASPack family. 7 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 728165ae7edfe342abfac697c54852e14128f1d052ae42b7fa22a39b9b27ee68
SHA-1: 20f41a19c13d654733c09be875da9cd04bbc77f6
MD5: 44daf065c0c5d40c73a6819320af791a
imphash: 430f0d0eb90755dacb454d76817d014e
ssdeep: 1536:GzfMMkPZE1J7S6/PMj42VJEY4ujMepJtANuOAl0QQsIEySYndfcUPM:EfMNE1JG6XMk27EbpOthl0ZUed0UE
TLSH: T1903ABE921190C331EADBAC57E64AD7EDFA87CC0E833079AE882767362745007E589747
Submitted as: 728165ae7edfe342abfac697c54852e14128f1d052ae42b7fa22a39b9b27ee68
File type: pe · Size: 95651 bytes
Verdict: malicious (100/100) · Family: ASPack

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.MPRESS1
ClamAV (daily): Win.Ransomware.Generickdz-9866467-0
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:MPRESS
Microsoft Defender: Trojan:Win32/QQPass!pz
Trellix Stinger (McAfee): Trojan-FFZL!FCDEED0499F3
Kaspersky (KVRT): Trojan.Win32.Scar.oetk

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Ransomware.Generickdz-9866467-0 (rule Win.Ransomware.Generickdz-9866467-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/QQPass!pz (rule Trojan:Win32/QQPass!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FFZL!FCDEED0499F3 (rule Trojan-FFZL!FCDEED0499F3) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Scar.oetk (rule Trojan.Win32.Scar.oetk) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MPRESS (rule DIE:MPRESS) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.MPRESS1 (rule high-entropy-sections:.MPRESS1) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-sections:.MPRESS1, MPRESS - static signal, weight 0.25, confidence 0.55
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

23038 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\Sysqempmblq.exe - 83e029816ecf412f7e3b657c0cfe26109e3ab3e1aae572a048f5bc349516c6d5
C:\Users\analyst\AppData\Local\Temp\qpath.ini - 4e717aa4bea34ed15f06d9abbdbe96b2a7e98ead703f3f6bc4376acceea10164
C:\Users\analyst\AppData\Local\Temp\Sysqamqqvaqqd.exe - ef6f140b52fb9ee89b88fbe46e37e24b2e269cc71629ec58ae9ebb859e185184

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788066383&P2=404&P3=2&P4=jaWnjEZ%2bR3On1i9AtFJyhaqWYXzT1kYJUvezoiZrwyID2MNe%2b9vl57qsRp%2bkaq2gtXUXTWL5n4Uii2TH3e%2fmVQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

85.210.196.11
20.50.201.206
52.123.252.202
52.230.59.222
4.230.171.124
57.154.63.210
74.178.240.51
52.168.117.175
135.232.92.137
104.18.33.89
135.233.45.223
203.26.79.13
52.110.12.26
52.110.12.51
135.234.160.244
20.184.175.8
52.168.112.66
52.123.252.224
74.178.232.29
52.123.252.226
72.145.35.98
52.110.12.42
52.148.114.188

More ASPack samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report