MALICIOUS — 772827421f4f662842b60aedde0ccdbafff4335c75a1e53e8e934a38772ed3da

MALICIOUS — 772827421f4f662842b60aedde0ccdbafff4335c75a1e53e8e934a38772ed3da is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Shifu family. 5 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 772827421f4f662842b60aedde0ccdbafff4335c75a1e53e8e934a38772ed3da
SHA-1: b8c9d2e0a1cf48357c3b05c329c4c54601b4cdc6
MD5: 37a7c5ff70c20b44e10d5b2df30f5ca4
imphash: 29c4c5f8766667965cf6248336ce2ba0
ssdeep: 3072:6W/Qc+sSxnTrGadgsFqZeo4pwkhUmZr3hPsOraS:6W/2sSxTrGvsFUejWyZr3hPswa
TLSH: T1D74013AA665057DECDCFC761CC04C68F92A8574632F0EAD40652D2E2F8389B3D2C9646
Submitted as: 772827421f4f662842b60aedde0ccdbafff4335c75a1e53e8e934a38772ed3da
File type: pe · Size: 172032 bytes
Verdict: malicious (98/100) · Family: Shifu

Detections (5 of 55 engines)

ClamAV (daily): Win.Trojan.Gamarue-9832405-0
Microsoft Defender: Trojan:Win32/Astaroth!pz
Emsisoft (Emergency Kit): Trojan.Agent.EZWM
Trellix Stinger (McAfee): Trojan-Shifu!37A7C5FF70C2
Kaspersky (KVRT): Trojan-Banker.Win32.Shifu.eph

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Trojan.Gamarue-9832405-0 (rule Win.Trojan.Gamarue-9832405-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Embedded network infrastructure: 2.1.0.3 - static signal, weight 0.35, confidence 0.60
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

5777 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\ProgramData\2d0dh6j028.exe - 80e33715a71cbe0538a6a6df0a6d0b49d1fe96f68d490183eb94d220ab4fe6e2
C:\ProgramData\kdl26EE.tmp.bat - 978fe9e95077b56dd24995ad08515d04f6db9083dcc42ff327fbc9099412af8b
C:\Users\analyst\AppData\Local\Temp\3492473cd35c8bdceed8 - bf0b1137b3cd9575a1296539244917036c8cd3ae9ab87e6d0451eed3ce760f02

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787896559&P2=404&P3=2&P4=lZ7Wk6Q7jEZCFKuX0eylJj4BmkLb8DK3wkLk6bosaZ5MfzfD55Ux6u7bFNpbqvfenuZ%2bxOj%2fLE41bA4SaPT90A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded IP addresses

2.1.0.3
104.46.162.230
52.123.252.245
4.230.171.124
172.215.188.225
4.144.132.223
135.233.95.144
135.232.92.97
20.42.72.131
74.179.77.204
20.236.44.162
52.123.128.14
40.99.134.2
52.123.129.14
40.79.167.10
52.123.252.238
135.233.45.221
203.26.79.13
40.84.85.40
52.148.114.188
52.110.12.44
52.110.12.16
52.123.252.224
135.232.92.34
72.154.7.109

More Shifu samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report