MALICIOUS — virussign.com_2c508f8cd33332662e6a235bf955d220.vir

MALICIOUS — virussign.com_2c508f8cd33332662e6a235bf955d220.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Kazy family. 6 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 7c9761e86f4c2a31568daf455af4f5f589a8c5549b5f9204e7477562f564ba96
SHA-1: e12e13338531f7410618dd0c5c91b830658959fe
MD5: 2c508f8cd33332662e6a235bf955d220
imphash: bef229bd8a414afbbd1edba1aeb00206
ssdeep: 384:Q98xUHQMltCDuby4Ng8zLeiX5ereG1VNwLrQysIkscA8wDnr52XRGdPg:TwVCw/gopXg3wLrGVARt2hGdPg
TLSH: T11F2F9DADC520E39DD682E11231C2DC8FE87273EED599E82F19918B705DE44237C72A48
Submitted as: virussign.com_2c508f8cd33332662e6a235bf955d220.vir
File type: pe · Size: 32768 bytes
Verdict: malicious (100/100) · Family: Kazy

Detections (6 of 52 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Kazy-6838217-0
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
Microsoft Defender: Trojan:Win32/Injector.ARA!MTB
Emsisoft (Emergency Kit): Gen:Variant.Downloader.849
Kaspersky (KVRT): HEUR:Trojan.Win32.Miancha.gen

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Trojan.Kazy-6838217-0 (rule Win.Trojan.Kazy-6838217-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Injector.ARA!MTB (rule Trojan:Win32/Injector.ARA!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Downloader.849 (rule Gen:Variant.Downloader.849) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

114 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/6388/files/b51028a793b6e76e813bfe639d1d3af8cc0cef3e58ed9883b8d7604a11fb84ef - b51028a793b6e76e813bfe639d1d3af8cc0cef3e58ed9883b8d7604a11fb84ef

Registry keys

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

More Kazy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report