MALICIOUS — 85e160e787e51bf8a500a6b4b65bd97abab52b7cde707bdab013c41fff530a85

MALICIOUS — 85e160e787e51bf8a500a6b4b65bd97abab52b7cde707bdab013c41fff530a85 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Vmprotect family. 7 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 85e160e787e51bf8a500a6b4b65bd97abab52b7cde707bdab013c41fff530a85
SHA-1: 9b2f60d65d2356565a17b9ac7fc9a5dbfb57cf17
MD5: 9333366ca185db29526d370d84d5f8b4
imphash: 7184fc9596d8d6d6d2b2b761ab9e2133
ssdeep: 12288:SYzGVM3VyJgeE7uXsQeVtBKNkWPamSNREav8xUUH5gum:SPMl6gl7PJV3KCP4x5bm
TLSH: T1204A231639019DC1F2205906EC6A4E3D7DC7BBBBB1122C85360155BD2A15EEF2E324BB
Submitted as: 85e160e787e51bf8a500a6b4b65bd97abab52b7cde707bdab013c41fff530a85
File type: pe · Size: 448228 bytes
Verdict: malicious (100/100) · Family: Vmprotect

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
ClamAV (daily): Win.Packed.Vmprotect-10023076-0
YARA: Yara-Rules community: YR_Packer_VMProtect
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Barys.GXV!MTB
Emsisoft (Emergency Kit): Gen:Variant.Barys.160809
Kaspersky (KVRT): HEUR:Trojan.Win32.Convagent.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Packed.Vmprotect-10023076-0 (rule Win.Packed.Vmprotect-10023076-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Barys.GXV!MTB (rule Trojan:Win32/Barys.GXV!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Barys.160809 (rule Gen:Variant.Barys.160809) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Convagent.gen (rule HEUR:Trojan.Win32.Convagent.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_Packer_VMProtect (rule YR_Packer_VMProtect) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Themida/VMProtect (rule Themida/VMProtect) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Themida/VMProtect, high-entropy-sections:.vmp1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

97 behavior events · 0 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Program Files (x86)\rsjtqiqv\ouo.exe - b906c3d5265d3ecb56be150dbbf886af3e3579888e617701eaeb27f052f87d80
6105b1267078b83bb14e0c3a06f6e71f6d27dd7a04c727bd958a3bfc21880760 - 6105b1267078b83bb14e0c3a06f6e71f6d27dd7a04c727bd958a3bfc21880760

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

4.150.223.106
52.123.252.212
4.230.171.124
4.247.188.224
20.247.184.197
135.233.95.144
74.178.240.51
4.150.223.112
51.11.192.48
20.165.94.63
52.110.12.40
52.110.12.49

More Vmprotect samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report