MALICIOUS — 83b9417e1b1f297c14a21018882be78d3c2cbcba28e682f35b652dc810a5ec64

MALICIOUS — 83b9417e1b1f297c14a21018882be78d3c2cbcba28e682f35b652dc810a5ec64 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fileinfector family. 4 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 83b9417e1b1f297c14a21018882be78d3c2cbcba28e682f35b652dc810a5ec64
SHA-1: 16a78aea161ddb1da42eff908e321f26834b03bb
MD5: 38326c84ce694679e521e6b2956b3a91
imphash: a9192bab5c7c795c7488b69a1853f9c2
ssdeep: 3072:MEsmG7EsmG7EsmG7EsmG7EsmGNEsmG7EsmA+W2Y3:MZVZVZVZVZPZVZh+W2Y3
TLSH: T1F448DCD531553310EDF0F859AD04AC2CB192DDA662363BE82802D47F74B97F706A982E
Submitted as: 83b9417e1b1f297c14a21018882be78d3c2cbcba28e682f35b652dc810a5ec64
File type: pe · Size: 369537 bytes
Verdict: malicious (100/100) · Family: Fileinfector

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Fileinfector-9831963-0
Microsoft Defender: Trojan:Win32/CryptInject!pz
Trellix Stinger (McAfee): Trojan-FUFL!38326C84CE69
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Fileinfector-9831963-0 (rule Win.Malware.Fileinfector-9831963-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/CryptInject!pz (rule Trojan:Win32/CryptInject!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FUFL!38326C84CE69 (rule Trojan-FUFL!38326C84CE69) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.ks (rule Virus.Win32.Lamer.ks) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 15 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.pinkworld.com, http://www.youporn.com, http://www.redtube.com - static signal, weight 0.35, confidence 0.60
Dropped 23 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

84490 behavior events · 2 ATT&CK techniques · 38 dropped files.

Dropped files

C:\Windows\WindowsUpdate.log - b8c5666c92e328c0319bb8ccc270dc0e617ec8f3b4186352f9972be9ef5889cb
C:\Windows\System32\msvcp140_2.dll - b796d3b41068c903cdee1647d6ffd3c659c010c0470e08e63aa0e1c062b7af00
C:\Windows\System32\mmc.exe.config - e46623bc9bc33e666186050676b975c7b943b822255636fa96888629a5c89a64
C:\Windows\System32\concrt140.dll - 73d5c8933b5e3cb4c29c03177bd36349a66e25679920fbea79697249ab7983f6
C:\Windows\System32\msclmd.dll - 8d144156e9b44eebe738be12617213e2c798e36f106acc87a4beaa029058e579
C:\Windows\System32\vccorlib140.dll - f521e004bf1f94d9b700a4d8203c6e485a0564f10b7309f71bf980bdea99025d
C:\Windows\System32\PrintConfig.dll - eaed4836fdd9db39891e7f0de8fe7f786685bcf1f4347e07ada9b5a11f18f6e3
C:\Windows\win.ini - 27ccc55c7c0854380378ecd746e333342334a0760a8a6e900aeedf9805979801
C:\Windows\System32\msvcp140.dll - 7a2a550ba70de94cad29308236247b897f59ec693f289a0d938105ff361d7298
C:\Windows\setupact.log - d1e7fba94f00e723271ee8ccb35da297bcf84c070cab387357b5eb63a42509fd
C:\Windows\System32\mfcm140.dll - b591bb860b97191f5b27c6386c6692adc694f10837d44c6265acceb2870cde24
C:\Windows\System32\vcruntime140.dll - 73aa86dc80c0e83202818b08fa9dfb4628fdcb93dbadf11397bfd28fd907a803
C:\Windows\setuperr.log - 59d36ab020022c1296d85b66d15df5b3aa1683306ef201674587849067bc730e
C:\Windows\System32\dssec.dat - 96cedf753e2a754b9a71d590bc7ea0c504f939a89b0985f90424460b8fbd831f
C:\Windows\pyw.exe - d228c1b51b856e3b4379d3498262b43132b9fb1a26b51d93dfb0d0623925cd3d

Embedded URLs

http://www.pinkworld.com
http://www.youporn.com
http://www.redtube.com
http://www.assparade.com/
http://www.freeav.com/
http://www.antispyware.com/
http://www.antivirus.com/
http://www.ticrf.org.tw/chinese/html/06-rating-1.htm
http://www.ticrf.org.tw/chinese/html/06-rating-v11.htm
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.pinkworld.com
www.youporn.com
www.redtube.com
www.assparade.com
www.freeav.com
www.antispyware.com
www.antivirus.com
www.ticrf.org.tw
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.65.88
52.123.252.242
52.230.60.54
4.230.171.124
4.247.188.233
52.110.12.50
52.110.12.48
172.178.240.163
85.210.196.11
20.184.175.17
20.52.64.200
52.148.114.188
52.110.12.38
52.110.12.1
72.154.7.110

More Fileinfector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report