MALICIOUS — 8945e8d845b966a8f090f8273feb087446c94ad3ea5e9294a718e482fa210ef8
MALICIOUS — 8945e8d845b966a8f090f8273feb087446c94ad3ea5e9294a718e482fa210ef8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the Eclz family. 5 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
8945e8d845b966a8f090f8273feb087446c94ad3ea5e9294a718e482fa210ef8 - SHA-1:
1bf95508bf8b419b90208e93cef6847d8c0c06d8 - MD5:
0a0915d06d3dac6dbda1c957e9525af0 - imphash:
e780223af31e5cc3f52e2ebb06482260 - ssdeep:
6144:dXC4vgmhbIxs3NBR3XZg7g9i2rx9wb7pJ2iR1Qud+6DR5NYWYqRNx:dXCNi9BlXogok9wbd8iR1Qm+GNYoNx - TLSH:
T17D47022612943A5CF0A34990A17CDF4F103B50A5B9F2878AEB56DA5CE3C04775F322DA - Submitted as: 8945e8d845b966a8f090f8273feb087446c94ad3ea5e9294a718e482fa210ef8
- File type: pe · Size: 345440 bytes
- Verdict: malicious (92/100) · Family: Eclz
Detections (5 of 55 engines)
- ClamAV (daily): Win.Malware.Eclz-9953021-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Worm:Win32/Sfone!pz
- Emsisoft (Emergency Kit): Gen:Heur.Mint.Murphy.3
- Kaspersky (KVRT): Worm.Win32.Agent.cp
MITRE ATT&CK
Why this verdict
The malicious score of 92/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Win.Malware.Eclz-9953021-0 (rule
Win.Malware.Eclz-9953021-0) - engine signal, weight 0.90, confidence 0.95 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
File paths
- C:\password.txt
- C:\debug.txt
More Eclz samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report