MALICIOUS — 8a5283e1185b65dbe27a80e1160c3c6d74d7b2b9f617d56b0f6b3e08df34a116

MALICIOUS — 8a5283e1185b65dbe27a80e1160c3c6d74d7b2b9f617d56b0f6b3e08df34a116 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100). 3 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 8a5283e1185b65dbe27a80e1160c3c6d74d7b2b9f617d56b0f6b3e08df34a116
SHA-1: a960ac6050b4e892d36f90a48bc1238f166a37b4
MD5: 1fc16b45d3876d9273758f17f6d122ac
imphash: ca943f2cfd74f683932e6497ba3e1a3c
ssdeep: 196608:queveHvUWvo6hTsPufmLWS0CAbe9X5k5:SveHdXTcujSHAz5
TLSH: T1056633068A1B3153D9FACD588C48DDCD5963F84C3AB1E2496F07D95E38E24B7B8B0A44
Submitted as: 8a5283e1185b65dbe27a80e1160c3c6d74d7b2b9f617d56b0f6b3e08df34a116
File type: pe · Size: 6564825 bytes
Verdict: malicious (91/100)

Detections (3 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
Detect It Easy (packer/type): DIE:Microsoft Linker
Kaspersky (KVRT): HEUR:Trojan-Spy.Python.KeyLogger.af

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 91/100 is the fusion of 7 weighted signals:

Kaspersky (KVRT) flagged HEUR:Trojan-Spy.Python.KeyLogger.af (rule HEUR:Trojan-Spy.Python.KeyLogger.af) - engine signal, weight 0.55, confidence 0.85
1 IDS alert(s): ThreatLens Telegram bot C2/exfil - network signal, weight 0.50, confidence 0.80
Contacted 1 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Microsoft Linker (rule Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 5 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

3750 behavior events · 0 ATT&CK techniques · 22 dropped files.

Dropped files

C:\_MEI38002\certifi\cacert.pem - fa883829ebb8cd2a602f9b21c1f85de24cf47949d520bceb1828b4cd1cb6906c
C:\_MEI38002\_hashlib.pyd - f30c2ba198207b869d10d8ce9480046b0efb310ec512feb5e9b3c5ffe981ea6d
C:\_MEI38002\_ctypes.pyd - 32c04926a1274933ec4de19baa311c0f719f6cdbcd0036ae4308e0e3416af850
C:\_MEI38002\python310.dll - d48d04acf590ee78011451b9dec67f79456f5e1efb8d8a7825b18b2a931b061b
C:\_MEI38002\_overlapped.pyd - 5d1b74c480480cf18203ada9fa85801c77ded601a6597f28b630ffad47523e28
C:\_MEI38002\libffi-7.dll - 1a106569ac0ad3152f3816ff361aa227371d0d85425b357632776ac48d92ea8a
C:\_MEI38002\_ssl.pyd - 241d132755da9bdc8c868c9b31f8c4b88cfdcd96396f07707e60aff53f704dd1
C:\_MEI38002\select.pyd - b6208b19837472f2126e8978492494a2e73ff1ba86d9bb4af7dcdc258f012db7
C:\_MEI38002\pyexpat.pyd - 127d6d0fb302d6f04e3873f2c55b225a7a42de94c987fa681a272dd2e1341968
C:\_MEI38002\libcrypto-1_1.dll - c782a52512461a4e0ea1f0a8d33d53b3d476e50a48dde79aab4a776e4eec6b1e
C:\_MEI38002\unicodedata.pyd - c1302a9f674489811fa8f81db3e8987e79674fba64e7758e82c4805b84cf67f2
C:\_MEI38002\VCRUNTIME140.dll - e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
C:\_MEI38002\_socket.pyd - 9df6be8ee4de01246b4eb6ad193b18c915340f840c69db5f947b708dd1356ddf
C:\_MEI38002\_decimal.pyd - fc910ec5679201914c63ea966d204749137795aa2d2b83fe1d1f243b1f63be76
C:\_MEI38002\_lzma.pyd - fdc69f9a6f99fa762374e9a39dbafe3a8a37072939f230c998f5ca65614ea456

Embedded URLs

http://schemas.microsoft.com/SMI/2016/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

schemas.microsoft.com
dd.fr
zd.ws
api.telegram.org

Embedded IP addresses

20.184.175.14
52.253.84.76
4.230.171.124
172.215.188.225
72.154.7.108
52.148.114.188
149.154.166.110
52.110.12.42
52.110.12.56

File paths

r:\$
X:\-@7{
T:\S/vM
s:\:O

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report