MALICIOUS — 74a9c0c9007f189951f1a658faedb5b9c5777114c8664b4f09b6dfb76a036174

MALICIOUS — 74a9c0c9007f189951f1a658faedb5b9c5777114c8664b4f09b6dfb76a036174 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Barys family. 7 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 74a9c0c9007f189951f1a658faedb5b9c5777114c8664b4f09b6dfb76a036174
SHA-1: 5b2493b92b7a39d2853a8522ca174663a2fd354b
MD5: 319b44308d6ef6f6907bcf84a837ac17
imphash: ac9eb1085b6eee2907a6ad89926cf94d
ssdeep: 768:c7Vcddp9Nkcy1roWSUDBtVa4uvTwnGr/Fkv2:codJctowDfVa4krrN22
TLSH: T1432EE1AE86DD3EFFC6F55B8621809C7C88005C9912BB1A647151C51AC4E463FE8EF249
Submitted as: 74a9c0c9007f189951f1a658faedb5b9c5777114c8664b4f09b6dfb76a036174
File type: pe · Size: 31376 bytes
Verdict: malicious (100/100) · Family: Barys

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:CODE
ClamAV (daily): Win.Malware.Barys-9916803-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Variant.Stealer.210
Kaspersky (KVRT): HEUR:Trojan-Downloader.Win32.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Barys-9916803-0 (rule Win.Malware.Barys-9916803-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Vindor!pz (rule Trojan:Win32/Vindor!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Stealer.210 (rule Gen:Variant.Stealer.210) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.Win32.Agent.gen (rule HEUR:Trojan-Downloader.Win32.Agent.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:CODE (rule high-entropy-sections:CODE) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:CODE, Turbo Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

16443 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

24bcf680ab0693e6def9cc36f1a5d248b0f0700598924d11500557d0e19e6ed4 - 24bcf680ab0693e6def9cc36f1a5d248b0f0700598924d11500557d0e19e6ed4

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

schemas.microsoft.com
zb.netba8.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.12
4.144.132.114
52.123.252.238
4.230.171.124
104.18.33.89
4.247.188.233
162.159.142.9
4.195.116.8
40.115.75.193
52.123.252.243
52.110.12.38
52.110.12.18
20.89.1.10
52.168.117.170
85.210.196.11
72.154.7.113
52.148.114.188
52.110.12.32
52.110.12.40

More Barys samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report