MALICIOUS — 7c2691b52632153bd13797b0ab6e99bfb1253dcd9c9e13870f819d7ea47abb5d
MALICIOUS — 7c2691b52632153bd13797b0ab6e99bfb1253dcd9c9e13870f819d7ea47abb5d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the FlyAgent family. 10 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.
Identification
- SHA-256:
7c2691b52632153bd13797b0ab6e99bfb1253dcd9c9e13870f819d7ea47abb5d - SHA-1:
e48a8aef071dd760b1b0b5c1b468785b54d585c6 - MD5:
df1e64cd79701fd19c9fe183461bf392 - imphash:
849e8bf8b1e9307e9329d6a6a08d455f - ssdeep:
12288:IUW7RGGOZX3VHB/2rF5S5m4jLxTIL8zlvm5ok5TOBnNXH3fhYhAgnEEovs5CjG3L:IndGGK4FyLxMA+a4iBn1iu2bovNPu - TLSH:
T1764F23F4A9077D27C97A3E2B13E229BDCD87AA9105FB2C9161604119662F06B74037F3 - Submitted as: 7c2691b52632153bd13797b0ab6e99bfb1253dcd9c9e13870f819d7ea47abb5d
- File type: pe · Size: 754524 bytes
- Verdict: malicious (100/100) · Family: FlyAgent
Detections (10 of 56 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.FlyAgent-9850229-1
- YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Detect It Easy (packer/type): DIE:Microsoft Linker
- LIEF (executable format parser): lief:invalid-authenticode
- Microsoft Defender: Trojan:Win32/FlyAgent!pz
- Emsisoft (Emergency Kit): Generic.Dacic.4803.B967D806
- Trellix Stinger (McAfee): Flyagent.d
- Kaspersky (KVRT): HEUR:Trojan.VBS.Agent.gen
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 20 weighted signals:
- ClamAV (daily) flagged Win.Malware.FlyAgent-9850229-1 (rule
Win.Malware.FlyAgent-9850229-1) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/FlyAgent!pz (rule
Trojan:Win32/FlyAgent!pz) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Generic.Dacic.4803.B967D806 (rule
Generic.Dacic.4803.B967D806) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged Flyagent.d (rule
Flyagent.d) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.VBS.Agent.gen (rule
HEUR:Trojan.VBS.Agent.gen) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule
DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.55, confidence 0.70 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
- Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule
DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70 - LIEF (executable format parser) flagged lief:invalid-authenticode (rule
lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule
UPX) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://sf.symcb.com/sf.crl0a, https://d.symcb.com/rpa0, http://sf.symcb.com/sf.crt0 - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
- Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
32059 behavior events · 2 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- officeclient.microsoft.com
- windows.msn.com
- www.msn.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
Dropped files
- C:\Users\analyst\AppData\Roaming\Microsoft\VBS3.vbs -
a99207e8eb6b571e1d944f043c9e3c83ec1cca88cbc529fc84546497ec3ba5da - C:\Users\analyst\AppData\Roaming\Microsoft\svchcst.exe -
dd18fbb1b46fd489a12eeb5c5277ffa0db63403af1f1c1f63c03c514b4379be6 - 77e01faf966f2452b3f6e5a18a6a4d4d7e5c452d265bef7ad817d2b1691f91cc -
77e01faf966f2452b3f6e5a18a6a4d4d7e5c452d265bef7ad817d2b1691f91cc
Embedded URLs
- http://crl.thawte.com/ThawteTimestampingCA.crl0
- http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
- http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
- https://www.verisign.com/rpa
- http://sf.symcb.com/sf.crl0a
- https://d.symcb.com/rpa0
- http://sf.symcb.com/sf.crt0
- https://www.verisign.com/cps0*
- https://www.verisign.com/rpa0
- http://logo.verisign.com/vslogo.gif04
- http://crl.verisign.com/pca3-g5.crl04
- http://sv.symcb.com/sv.crl0a
- http://sv.symcb.com/sv.crt0
- http://www.symauth.com/cps0
- http://www.symauth.com/rpa00
- http://s1.symcb.com/pca3-g5.crl0
- http://www.eyuyan.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
- http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
- http://yr.c.lencr.org/
Embedded domains
- crl.thawte.com
- ts-aia.ws.symantec.com
- ts-crl.ws.symantec.com
- www.verisign.com
- sf.symcb.com
- d.symcb.com
- logo.verisign.com
- crl.verisign.com
- sv.symcb.com
- www.symauth.com
- s1.symcb.com
- www.eyuyan.com
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 51.105.71.136
- 52.123.252.235
- 4.144.132.223
- 4.230.171.124
- 135.234.160.245
- 135.233.45.223
- 162.159.142.9
- 4.150.223.104
- 51.132.193.105
- 52.110.12.1
- 52.110.12.22
- 4.247.188.233
- 57.155.101.212
- 52.148.114.188
- 52.110.12.2
- 72.153.5.61
- 52.110.12.26
File paths
- C:\Programi\
More FlyAgent samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report