MALICIOUS — 856d75ea8143ad8566e5c3fed7e73bbe415260b9510fc73b29dfb8a85cfed7ee

MALICIOUS — 856d75ea8143ad8566e5c3fed7e73bbe415260b9510fc73b29dfb8a85cfed7ee is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the ASPack family. 7 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 856d75ea8143ad8566e5c3fed7e73bbe415260b9510fc73b29dfb8a85cfed7ee
SHA-1: 983f00ed54d651d9a82d218f97efb46a70319304
MD5: 56811b5d657e93f75d73800ab704d01c
imphash: 29c4c5f8766667965cf6248336ce2ba0
ssdeep: 3072:F6pQc+sSxnTrGadgsFqZeo4pwkhUmZr3hPsOraSo:F6p2sSxTrGvsFUejWyZr3hPswaH
TLSH: T1063E12B756506AEECECBD730CC00968F5665234320B8EED40766D251F878973E28B64B
Submitted as: 856d75ea8143ad8566e5c3fed7e73bbe415260b9510fc73b29dfb8a85cfed7ee
File type: pe · Size: 143360 bytes
Verdict: malicious (99/100) · Family: ASPack

Detections (7 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.MPRESS1
ClamAV (daily): Win.Trojan.Gamarue-9832405-0
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:MPRESS
Microsoft Defender: Trojan:Win32/Astaroth!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.111001
Kaspersky (KVRT): Trojan-Banker.Win32.Shifu.eph

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.Gamarue-9832405-0 (rule Win.Trojan.Gamarue-9832405-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:MPRESS (rule DIE:MPRESS) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 2.1.0.3 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.MPRESS1, MPRESS - static signal, weight 0.25, confidence 0.55
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

9084 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\ProgramData\284j0b2hf4.exe - 1d12d51b659f6c21b6c9875b872ac7820a1695e4e860e3adad51f58e76c58123
C:\Users\analyst\AppData\Local\Temp\tsk_058f71df4c80442a.exe - 251197ba6cadcbea4ef5a247772a83187d84b1d67495f02b2bfd490efb8779d1
C:\Users\analyst\AppData\Local\Temp\3492473cd35c8bdceed8 - 78051e0d69fe1d2a5b5f0a5ec8e8a81d771ea057f1599f699cbdf28af06533b8

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787850359&P2=404&P3=2&P4=Rg8KlqV40w%2f0LIeUcw4JFolaJc%2fxFkWqtL89SYF19ThojZwnSbPd14cPBjmoS68ateeXJRYIp5OUN5lxLVIjqw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787850456&P2=404&P3=2&P4=Gfbal7nqnvcWVyIS%2fu267DBQANv9J0z7cJ60OPAfa%2bZuJneTWBBwcOEiPXfx5A2AjXB0x%2bgPLuYEFPfUw6UAcQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

2.1.0.3
52.168.117.170
57.154.63.210
4.230.171.124
52.230.60.54
135.233.95.144
74.178.76.54
52.168.117.171
20.231.239.246
40.99.134.18
52.123.129.14
52.123.128.14
40.103.64.226
203.26.79.13
135.234.160.246
51.11.192.51
51.105.71.137
52.110.12.24
52.110.12.4
52.148.114.188
74.178.76.44
52.123.252.195
40.84.97.4
135.234.160.245
72.145.35.109

More ASPack samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report