MALICIOUS — 756882f4fe12dcbfa27a8ac5872126c55100848c213c228e661e712d967391ab

MALICIOUS — 756882f4fe12dcbfa27a8ac5872126c55100848c213c228e661e712d967391ab is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the MSILZilla family. 4 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 756882f4fe12dcbfa27a8ac5872126c55100848c213c228e661e712d967391ab
SHA-1: 01bbc35a6e382219be0776789a82264780aa0933
MD5: 4a2be971a7d2b9fb36dc1e718dbf1887
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 384:MZ8KA7DAmbu56w/pHNXZayHYoztPBsUCbf/6Oufano5wACtQMyB:MZFAfAmbupamPBsUCruYotCtGB
TLSH: T1D631D58D8AB34905D0F8E3213818C99D589D5E17C2990C48F78BF9B50ADBDB356732D2
Submitted as: 756882f4fe12dcbfa27a8ac5872126c55100848c213c228e661e712d967391ab
File type: pe · Size: 41472 bytes
Verdict: malicious (100/100) · Family: MSILZilla

Detections (4 of 56 engines)

ClamAV (daily): Win.Packed.Gorgon-8180272-0
Microsoft Defender: TrojanDownloader:MSIL/XWormRAT.D!MTB
Emsisoft (Emergency Kit): IL:Trojan.MSILZilla.9005
Kaspersky (KVRT): UDS:Trojan.MSIL.Vobfus.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Packed.Gorgon-8180272-0 (rule Win.Packed.Gorgon-8180272-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged TrojanDownloader:MSIL/XWormRAT.D!MTB (rule TrojanDownloader:MSIL/XWormRAT.D!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged IL:Trojan.MSILZilla.9005 (rule IL:Trojan.MSILZilla.9005) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan.MSIL.Vobfus.gen (rule UDS:Trojan.MSIL.Vobfus.gen) - engine signal, weight 0.55, confidence 0.85
2 behavioral detection(s) across 2 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.43, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
Extracted RedLine config (0 C2) - engine signal, weight 0.45, confidence 0.60
Embedded network infrastructure: https://tacticaltokens.com/op.txt, 1.0.2.0 - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

3941 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

9a5929441a6b93e5634cc0100af59446d06ffec89f14e64e11974fed27ead4ee - 9a5929441a6b93e5634cc0100af59446d06ffec89f14e64e11974fed27ead4ee
65f9ad0649a4adc6e2d9a3b8ffe5c8031f4f14172158e728db5a49525991b3b0 - 65f9ad0649a4adc6e2d9a3b8ffe5c8031f4f14172158e728db5a49525991b3b0
693f71c5c0b61dc58695b60beaf25a03f4f5462e5e44abbf7306c8245f4f8568 - 693f71c5c0b61dc58695b60beaf25a03f4f5462e5e44abbf7306c8245f4f8568

Embedded URLs

https://tacticaltokens.com/op.txt
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

tacticaltokens.com

Embedded IP addresses

1.0.2.0
13.69.116.108
4.230.171.124
20.247.184.197
40.84.85.40
74.179.77.164
74.179.77.204
20.42.65.93
104.18.33.89
74.178.240.61
135.233.45.221
141.193.213.11
52.110.12.44
48.211.4.16
52.110.12.15

File paths

C:\Users\Administrator\source\repos\WindowsApp1\WindowsApp1\obj\Debug\WindowsApp1.pdb

More MSILZilla samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report