MALICIOUS — 7b7adf2b3c1427498dd65f844c47d97cc57549e0c865e3b32591ad3f2a125703

MALICIOUS — 7b7adf2b3c1427498dd65f844c47d97cc57549e0c865e3b32591ad3f2a125703 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Vobfus family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 7b7adf2b3c1427498dd65f844c47d97cc57549e0c865e3b32591ad3f2a125703
SHA-1: 429792bd7caf4886dd608a84afeac252bed6b79d
MD5: dda7227aca35904c362f1ffb70ac2b3f
imphash: b806352ebc796e5060cd13bc5e12711d
ssdeep: 1536:owl0ccYBnXOB+dGrNjjmJ2NuKuFr1M5Br2QbCcITt:AYBXOB++jOKbmt
TLSH: T1213B91D40CE8E0A1CEA497878E4469FC058EEDABB222507419C5AA1BD7C21FF507E15F
Submitted as: 7b7adf2b3c1427498dd65f844c47d97cc57549e0c865e3b32591ad3f2a125703
File type: pe · Size: 102400 bytes
Verdict: malicious (100/100) · Family: Vobfus

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Changeup-6169544-0
Microsoft Defender: Worm:Win32/Vobfus.EH
Emsisoft (Emergency Kit): Gen:Variant.Pronny.2
Trellix Stinger (McAfee): Trojan-FAEI!DDA7227ACA35
Kaspersky (KVRT): Trojan.Win32.Jorik.Vobfus.ahog

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Trojan.Changeup-6169544-0 (rule Win.Trojan.Changeup-6169544-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Worm:Win32/Vobfus.EH (rule Worm:Win32/Vobfus.EH) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Pronny.2 (rule Gen:Variant.Pronny.2) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FAEI!DDA7227ACA35 (rule Trojan-FAEI!DDA7227ACA35) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Jorik.Vobfus.ahog (rule Trojan.Win32.Jorik.Vobfus.ahog) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

42951 behavior events · 3 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Users\analyst\ydsim.exe - ef3578fe1faa5fc57d279a077fd2ccd21b522556a00990b602c96d64422e8ef6
3570f29f5d975a7e9f669f3e3eee4c69368a6f4a7f5713e7f97098979860d4eb - 3570f29f5d975a7e9f669f3e3eee4c69368a6f4a7f5713e7f97098979860d4eb
9a7e3999cd032052dcabffcb3c05e38124fb2bd0a24ed89bd69c197dfef1f013 - 9a7e3999cd032052dcabffcb3c05e38124fb2bd0a24ed89bd69c197dfef1f013
b07e75259bcc9751c7c350b3bce028b90af7a98c158545c5da3597c300d17850 - b07e75259bcc9751c7c350b3bce028b90af7a98c158545c5da3597c300d17850

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

ns1.spansearcher.net
ns1.spinsearcher.org
ns1.player1352.net

Embedded IP addresses

52.168.117.169
52.123.252.247
172.215.188.232
4.230.171.124
4.149.210.175
74.178.76.54
40.84.85.40
172.64.154.167
52.168.117.168
74.178.240.61
162.159.142.9
52.110.12.8
52.110.12.53
135.234.160.246
104.46.162.231
172.172.255.216
72.145.35.102
52.148.114.188
52.110.12.15
52.110.12.49

File paths

C:\Program
C:\Windows\system32;C:\Windows\system;

More Vobfus samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report