MALICIOUS — 1488.exe

MALICIOUS — 1488.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Aotera family. 3 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 817a18950c926f56172cdc3ebfde6ed402065c0a5e18cf582274aeaea0715341
SHA-1: 3328872fa67c35367c9f8ae937da06d7012487e5
MD5: e29ed72daa2da082b09bb7d10e0ed801
imphash: cf4276a70f071efbf419d732f8793de1
ssdeep: 49152:WQpm55PmHO0LNkhG18ayK7oRA8lvlaxFw:hu0xF1l
TLSH: T1F65CCF6402272171F5FAA8847C6CCEDC8471B0AD95329F5CA107EF6DCA5A5372AE02F4
Submitted as: 1488.exe
File type: pe · Size: 2425856 bytes
Verdict: malicious (99/100) · Family: Aotera

Detections (3 of 56 engines)

ClamAV (daily): Win.Malware.Aotera-10060486-0
YARA: Yara-Rules community: YR_AntiDebug_Checks
Kaspersky (KVRT): UDS:Trojan.Win64.BypassUAC.bbz

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Aotera-10060486-0 (rule Win.Malware.Aotera-10060486-0) - engine signal, weight 0.90, confidence 0.95
Kaspersky (KVRT) flagged UDS:Trojan.Win64.BypassUAC.bbz (rule UDS:Trojan.Win64.BypassUAC.bbz) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 4.2.1.0 - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

10657 behavior events · 2 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

github.com

Embedded IP addresses

4.2.1.0
20.184.175.19
4.230.171.124
40.84.97.4
52.230.60.54
135.233.95.135
20.184.175.12
74.178.76.128
104.18.33.89
20.42.179.204
172.178.240.162
92.223.78.30
52.148.114.188
72.145.35.109
52.110.12.51
52.110.12.40

More Aotera samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report