MALICIOUS — 72fb23280aac1fbff0efb2ed76b5671c42775a49c2e0950d3000ec0e106d83d1

MALICIOUS — 72fb23280aac1fbff0efb2ed76b5671c42775a49c2e0950d3000ec0e106d83d1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Beebone family. 7 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 72fb23280aac1fbff0efb2ed76b5671c42775a49c2e0950d3000ec0e106d83d1
SHA-1: 58a51527ee5dfec03f395b4b134c2b223db26985
MD5: 13d75c92d38d393d9d8805697d8f8bb9
imphash: 1bf41e5eccfe66b9b45a836c645ecf87
ssdeep: 6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiE50I1Btz:FytbV3kSoXaLnToslZqtz
TLSH: T127479DA7811B2161E9F6D9A4ACA04CECDC32F43C643AE58C9A03DC9DB0E6D37D4B1552
Submitted as: 72fb23280aac1fbff0efb2ed76b5671c42775a49c2e0950d3000ec0e106d83d1
File type: pe · Size: 323600 bytes
Verdict: malicious (97/100) · Family: Beebone

Detections (7 of 55 engines)

capa (capabilities): capability:credential-access
ClamAV (daily): Win.Malware.Beebone-9762279-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win64/Lazy!pz
Emsisoft (Emergency Kit): Trojan.Agent.GHOL
Kaspersky (KVRT): HEUR:Trojan.Win32.SelfDel.vho

MITRE ATT&CK

Why this verdict

The malicious score of 97/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Malware.Beebone-9762279-0 (rule Win.Malware.Beebone-9762279-0) - engine signal, weight 0.90, confidence 0.95
access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
Contacted 19 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

329 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\HBFTILLZXM.exe - 0baccaafb2e62eaa6ccea130e1930630ebacd0cf3e05cabde6f3c95c5c32e7f6

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787788834&P2=404&P3=2&P4=CpLdp6X3Sasbsc8jbrq1TqYwk4Ei3CAZLsBXXbuSvAtQzLQqfSkyGLIwi%2buoAMZUqLG3FnyfDCpMnQcAdj1ZsA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787788852&P2=404&P3=2&P4=MVWzblQvVvHhMFILlvQWotAqwIbwviKadYCHsWBYkSpDsn%2f%2fl9S3wZ8thPJiFCYGFOItsp4DZshkjArw9M0kNg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.184.175.22
4.247.188.224
4.230.171.124
4.144.132.223
135.232.92.34
135.233.95.144
74.179.77.164
40.79.150.122
203.26.79.13
52.123.129.14
20.231.239.246
52.123.128.14
40.99.133.226
20.42.73.27
135.233.45.221
52.148.114.188
72.153.5.97
52.110.12.25
52.110.12.42

File paths

C:\Users\swe_r\source\repos\LoaderRepacker\x64\Release\LoaderRepacker.pdb

More Beebone samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report