SUSPICIOUS — 82c049c7a820d02f58266298b6bd17399d20b842af2ecaedc0046140f47de3ea
SUSPICIOUS — 82c049c7a820d02f58266298b6bd17399d20b842af2ecaedc0046140f47de3ea is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (56/100). 6 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
82c049c7a820d02f58266298b6bd17399d20b842af2ecaedc0046140f47de3ea - SHA-1:
b0cc18f163124d7ad5d8005844f753da12cbf5e6 - MD5:
322335f6976a223f34e473afbe9d4d24 - imphash:
08ce2bb5c289c22487015109b09aeba3 - ssdeep:
196608:i8HotIJNcR2cxiKo5KQMVh1L/XXZboraiN/gvorjrzduncyX2y/:i8HocNhZ8QML1LNor5EKU/ - TLSH:
T1486A33664B61C98BC4EE3AA4963D0FFFA51BC1D5C2C799513974ED34E2A220FC649880 - Submitted as: 82c049c7a820d02f58266298b6bd17399d20b842af2ecaedc0046140f47de3ea
- File type: pe · Size: 9135406 bytes
- Verdict: suspicious (56/100)
Detections (6 of 52 engines)
- capa (capabilities): capability:execution/powershell
- MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
- Detect It Easy (packer/type): DIE:Themida/Winlicense
- Microsoft Defender: Trojan:Win32/Sabsik.FL.B!ml
- Emsisoft (Emergency Kit): Gen:Variant.Midie.100545
- Kaspersky (KVRT): UDS:Backdoor.MSIL.NanoBot.bewo
MITRE ATT&CK
Why this verdict
The suspicious score of 56/100 is the fusion of 3 weighted signals:
- execute via PowerShell (rule
execute via PowerShell) - capa signal, weight 0.40, confidence 0.80 - Detect It Easy (packer/type) flagged DIE:Themida/Winlicense (rule
DIE:Themida/Winlicense) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: Themida/VMProtect, high-entropy-sections: , , ,.boot, Themida/Winlicense - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded domains
- 7.sh
- ye.za
- pb.ai
- 6.pw
- 1.co
- dk.se
- gmail.com
File paths
- K:\fM
- y:\.-L
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report