MALICIOUS — 7cd988da89e451ed421ae93e141f41311e7db599ab6a92586512a10772f2129d

MALICIOUS — 7cd988da89e451ed421ae93e141f41311e7db599ab6a92586512a10772f2129d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100), attributed to the Lmir family. 8 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: 7cd988da89e451ed421ae93e141f41311e7db599ab6a92586512a10772f2129d
• SHA-1: 25853a8287300e023bf4ff3b05a7b7475772c26c
• MD5: 6afc28e75e31e5ecc91adca85693554a
• imphash: aae410db5a351d384de2e35faf59497e
• ssdeep: 12288:92JbM2yYl9yq8yj/TTFSqMKhearix+Gg6VF:92JbstUj/QqMuearixn7VF
• TLSH: T12F4AAEAF071A3747EAB7C6142C006F6E4063F8BA517D284C05A7C53EB3E789F6A60159
• Submitted as: 7cd988da89e451ed421ae93e141f41311e7db599ab6a92586512a10772f2129d
• File type: pe · Size: 432264 bytes
• Verdict: malicious (95/100) · Family: Lmir

Detections (8 of 52 engines)

• capa (capabilities): capability:collection/keylog
• ClamAV (daily): Win.Trojan.Lmir-22
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Microsoft Defender: Virus:Win32/Viking!atmnm
• Emsisoft (Emergency Kit): GenPack:Generic.Delf.Lmir.CE051F6F
• Trellix Stinger (McAfee): PWS-FCMH!6AFC28E75E31
• Kaspersky (KVRT): Trojan.Win32.Patched.rv

MITRE ATT&CK

• T1547.001
• T1057
• T1056.001

Why this verdict

The malicious score of 95/100 is the fusion of 6 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Lmir-22 (rule Win.Trojan.Lmir-22) - engine signal, weight 0.90, confidence 0.95
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://schemas.microsoft.com/SMI/2005/WindowsSettings
• http://www.digicert.com/CPS0
• http://crl3.digicert.com/sha2-assured-ts.crl02
• http://crl4.digicert.com/sha2-assured-ts.crl0
• http://crl3.digicert.com/assured-cs-g1.crl00
• http://crl4.digicert.com/assured-cs-g1.crl0L
• https://www.digicert.com/CPS0
• http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
• http://www.digicert.com/ssl-cps-repository.htm0
• http://crl3.digicert.com/sha2-assured-cs-g1.crl05
• http://crl4.digicert.com/sha2-assured-cs-g1.crl0L

Embedded domains

• logging.cc
• schemas.microsoft.com
• www.digicert.com
• crl3.digicert.com
• crl4.digicert.com
• cacerts.digicert.com

Registry keys

• HKLM\Software\Google\Update\
• HKCU\Software\Google\Update\
• HKLM\Software\Google\UpdateDev\
• HKLM\Software\Policies\Google\Update\

File paths

• X:\:`:d:r:
• J:\:
• L:\:l:
• X:\:`:d:h:l:p:t:x:
• T:\:d:l:t:

More Lmir samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report