MALICIOUS — 8ad3ae5348953f2006fbcd28a53dabc582500bf37929c46dd1fdc7c165369998

MALICIOUS — 8ad3ae5348953f2006fbcd28a53dabc582500bf37929c46dd1fdc7c165369998 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Vindor family. 9 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 8ad3ae5348953f2006fbcd28a53dabc582500bf37929c46dd1fdc7c165369998
SHA-1: c6ae2d361880de4b6db9496485bb9fa9b8d24de7
MD5: c346f8151d9e984c7b150dc8bf379f79
imphash: 45fd9b63a881719b9b56f34ef23b9c19
ssdeep: 3072:H8nVh2LecM+BeecM+BeAoHxQN89vGEGpqPL1/7w6ZAs+VBKcS2RaEiwMFCHV1G+:cVp+3+GHdeOQV5IwwGFzv2
TLSH: T15B4AAECD8137331FC2A6DD30A554CDED009174E621BDEB4DA642863BA0E5877AC3929E
Submitted as: 8ad3ae5348953f2006fbcd28a53dabc582500bf37929c46dd1fdc7c165369998
File type: pe · Size: 428333 bytes
Verdict: malicious (100/100) · Family: Vindor

Detections (9 of 55 engines)

capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): ASPack
ClamAV (daily): Win.Worm.Vindor-9886047-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Vindor.B
Emsisoft (Emergency Kit): Gen:Heur.Mint.Autorunner.1
Kaspersky (KVRT): Worm.Win32.AutoRun.vx

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Worm.Vindor-9886047-0 (rule Win.Worm.Vindor-9886047-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 22 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Packing/obfuscation: ASPack, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 26 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

24609 behavior events · 1 ATT&CK techniques · 28 dropped files.

Dropped files

C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccessinspector.exe - 9184668df27a6d40bcf757e70187173c3bdce38112cb9dbc54e5eb0146927209
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe - 3e27cc6407fc7d7b6e26495c6ff849c23cf3b6e9c8a885ea742ad7b3109af536
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - 51e57fdf672acec905dc11fb467293a6c1251683cb92e769d451e46b9e0e92d6
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe - daf8499e78463fcb90775480cad6c0d2f57401baf0f0017fecae03c7b2b690cf
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jrunscript.exe - 3c6d62569a6dbad19d57ab33039ea0626a3eaf4386fa8b207c136957b26005ab
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - c4c65264e0d3b9b31c5262259ec4b8af6ec62a1fff918a98910aabf17f015959
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe - d257355a9d6abf814f696cb746c2c5b51fa5a07b80396c4b2ea9c8ba2a35962d
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe - 8c435a45123e88410f42259fcb3b303b5f60ce00e01d8d4a9c5bd342bf51e184
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - 599e533da3261e2fc678ccc3393bb90cafa7ce620196168b9c5cb41a4e48099b
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccessinspector.exe - a7487ee88d94f322148489c818cc861ee1e77ec31ce5b5e7b5e999c0d5acf6f6
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaw.exe - 00293b1fc4c093b570c7a9433fb5b16b188e938061cacf6f7a35721a6f346acb
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - 83bbbfcf915b3cb5c4492cb9999a2a16f9208a9f1c29dfb7f03d6cb9629de031
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\kinit.exe - b22d9a1566c5256be347ebf0e99b837da6c290a41228996b92623688a340604b
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\klist.exe - 59fd870709a1651fb95ac74032b635e14d93bf578adff4b0d07bc0cfb82ba8ed

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://office.microsoft.com/0
http://www.microsoft.com/pki/certs/CSPCA.crt0
http://www.microsoft.com/pki/certs/tspca.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787891781&P2=404&P3=2&P4=K9k%2bLUUKl1eEXFIRq5tzS%2bgan%2f3687i%2bM4nDTgrdbFqbdDHeiDW%2fI1CVQutjRGmg5n%2bwIMyUDWOD1NSPLEQhEA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787891880&P2=404&P3=2&P4=Cl%2fAQMqKj8mxW0DqszTq2mi33LxEXtgEyHfVh48Xo7wBO88Cl0oN5OgcQunniVpZEI5pZbZ%2fRlXabpeV7%2fjHVg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com

Embedded IP addresses

20.184.175.2
52.123.252.241
85.210.193.152
4.230.171.124
20.247.184.142
74.179.77.204
74.178.240.51
51.104.15.253
20.76.201.171
52.123.128.14
52.123.129.14
135.234.160.245
203.26.79.13
52.148.114.188
74.178.232.29
20.42.65.84
20.42.73.30
52.123.252.238
72.145.35.107
20.42.179.204
52.110.12.44
52.110.12.4

Registry keys

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinFirewall

File paths

C:\Program
F:\Office\Target\x64\ship\postc2r\x-none\appsharinghookcontroller.pdb
d:\_Bld\10657\7994\Sources\obj\Win32\Release\EvaluationContainer.NetFX45.csproj\Microsoft.Mashup.Container.NetFX45.pdb
C:\Loggers\MyLogger.dll;OutputAsHTML
C:\My.dll
C:\Logger.dll
f:\dd\tools\devdiv\FinalPublicKey.snk
f:\dd\vsproject\xmake\XMakeCommandLine\objr\amd64\MSBuild.pdb
c:\vbvirus\ownerprotect.ptt
C:\905c0769f9a06c95a24ddf945\
C:\905c0769f9a06c95a24ddf945\patcher.exe

More Vindor samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report