MALICIOUS — 7e813881543e2893aae1f16401ea8e31e26e157a740e5926e1994d7b10ed116b

MALICIOUS — 7e813881543e2893aae1f16401ea8e31e26e157a740e5926e1994d7b10ed116b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Vmprotect family. 7 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 7e813881543e2893aae1f16401ea8e31e26e157a740e5926e1994d7b10ed116b
SHA-1: 0536a3bc98c2b87d967568d007f93230cb9e50e4
MD5: 9ad9ee010a7cdc53be769bded74f0761
imphash: f11f87642badc84e7fb44e3ac9b293a4
ssdeep: 12288:GsE05umZPem7nAW04hrr5px3V2HYnnZAsVM50MRKKTcT25KfjL6ZKeAfWOYTGjUJ:hZ5u8PemjFrzx3ocn/VM50OKqcTDbLkH
TLSH: T1254F230BEC4AC259D094E1F74D14AF0EC68C999716B8948E3253CABC85658FF872D8F1
Submitted as: 7e813881543e2893aae1f16401ea8e31e26e157a740e5926e1994d7b10ed116b
File type: pe · Size: 702202 bytes
Verdict: malicious (100/100) · Family: Vmprotect

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
ClamAV (daily): Win.Malware.Vmprotect-9910773-0
YARA: Yara-Rules community: YR_Packer_VMProtect
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/barys.RDB!MTB
Emsisoft (Emergency Kit): Gen:Variant.Barys.160809
Kaspersky (KVRT): HEUR:Trojan.Win32.Convagent.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Vmprotect-9910773-0 (rule Win.Malware.Vmprotect-9910773-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/barys.RDB!MTB (rule Trojan:Win32/barys.RDB!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Barys.160809 (rule Gen:Variant.Barys.160809) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Convagent.gen (rule HEUR:Trojan.Win32.Convagent.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_Packer_VMProtect (rule YR_Packer_VMProtect) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Themida/VMProtect (rule Themida/VMProtect) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Themida/VMProtect, high-entropy-sections:.vmp1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

126 behavior events · 0 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Program Files (x86)\onnnbzcqn\sgmmrmihitz.exe - 8da7e0549bc2ec59601555fa3d1266810651b6a7d9698f9ed6ac5b33f356227b
7732fcf4d53566dc01dab55e90a6f4108385948fc1f3cb23c20638bf99e5c1bb - 7732fcf4d53566dc01dab55e90a6f4108385948fc1f3cb23c20638bf99e5c1bb

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

20.184.175.2
52.123.252.202
20.42.179.204
4.230.171.124
4.247.188.224
20.247.184.197
135.233.95.135
135.233.95.144
4.150.223.96
104.18.33.89
52.182.143.212
20.42.65.91
74.179.77.204
40.84.85.40
52.110.12.19
52.110.12.3

File paths

Y:\e5

More Vmprotect samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report