MALICIOUS — photov_127567101143.lnk

MALICIOUS — photov_127567101143.lnk is a lnk sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the Sonbokli family. 2 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 87dc408d360c746222ffcee640d6a3f00b75c3f8f2265a0e40b666b3eb467d28
• SHA-1: 531766ca486037ce359cfdc2f6433dd9105fd78f
• MD5: 3007ff16ed958cb4d884e1f983a5cdc7
• ssdeep: 24:8okYUAlrhlQeGquu2dYW4Xn6zMNqCU4RVmOfrCm/Vv:8okTAlnQ5quRiWAn5NqCU4WODP/Vv
• TLSH: T15E1431C6017C1637C36885E84779D37E4986A02505FD6D059D63B4366103C53E9B35B2
• Submitted as: photov_127567101143.lnk
• File type: lnk · Size: 1755 bytes
• Verdict: malicious (93/100) · Family: Sonbokli

Detections (2 of 51 engines)

• Microsoft Defender: Trojan:Win32/Sonbokli.A!cl
• Kaspersky (KVRT): HEUR:Trojan.WinLNK.Agent.gen

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 93/100 is the fusion of 7 weighted signals:

• Microsoft Defender flagged Trojan:Win32/Sonbokli.A!cl (rule Trojan:Win32/Sonbokli.A!cl) - engine signal, weight 0.55, confidence 0.85
• Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
• Shortcut launches: powershell - static signal, weight 0.50, confidence 0.80
• Contacted 47 external host(s) at runtime (7 HTTP) - network signal, weight 0.40, confidence 0.80
• Contacted 47 external host(s) at runtime (7 HTTP) - network signal, weight 0.40, confidence 0.80
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

986 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• desktop-hsgcbep
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• ctldl.windowsupdate.com
• www.msftconnecttest.com
• 252.0.0.224.in-addr.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• login.live.com
• ocsp.digicert.com
• v10.events.data.microsoft.com
• tas02.sls.update.microsoft.com
• 1.0.240.10.in-addr.arpa
• 172.30.101.151.in-addr.arpa
• 85.52.40.23.in-addr.arpa
• 255.0.240.10.in-addr.arpa
• 157.37.11.23.in-addr.arpa
• 20.167.190.20.in-addr.arpa
• 137.92.232.135.in-addr.arpa
• 251.0.0.224.in-addr.arpa
• 136.71.105.51.in-addr.arpa

Embedded domains

• wolkamo.com

Embedded IP addresses

• 23.11.37.157
• 52.168.117.168
• 23.40.52.85
• 135.232.92.137
• 172.215.188.225
• 51.105.71.136
• 57.155.104.224
• 40.84.97.4
• 20.184.175.7
• 20.42.179.204
• 151.101.30.172
• 20.190.167.20
• 57.154.63.210
• 199.232.138.172
• 74.178.232.29
• 74.178.240.61
• 4.150.223.113
• 23.214.54.132
• 104.68.3.77
• 20.184.175.6
• 4.247.188.233
• 20.42.65.90
• 203.26.79.13
• 20.42.179.192
• 20.184.175.12

More Sonbokli samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report