MALICIOUS — 8b2e8ad82190028b32c46848d588e1dc9018cae016e0e12f15b682bd09fc60a0

MALICIOUS — 8b2e8ad82190028b32c46848d588e1dc9018cae016e0e12f15b682bd09fc60a0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Viking family. 7 of 25 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 8b2e8ad82190028b32c46848d588e1dc9018cae016e0e12f15b682bd09fc60a0
SHA-1: 6111ab4ce99d96310eb89cee617569f76fd8d406
MD5: 5c3e856f1e2ca653886fb6ffadaf1629
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 49152:HanPByHwdcJVTXDDsFHttaeU6yrNw0pL5DYZD68Zt30U:0BndwEgZtG9
TLSH: T1215D6D9A00172122D0F9ED45B431C9DDD063F819993599CE9202DA1BD3A9EBBBBF00F5
Submitted as: 8b2e8ad82190028b32c46848d588e1dc9018cae016e0e12f15b682bd09fc60a0
File type: pe · Size: 2841928 bytes
Verdict: malicious (100/100) · Family: Viking

Detections (7 of 25 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
YARA: JPCERT/CC: JPCERT_Emotet
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Virus:Win32/Viking.MS
Emsisoft (Emergency Kit): Trojan.Agent.FPMF
Kaspersky (KVRT): Virus.Win32.Lamer.xe

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

Dropped a malicious payload (Viking): 224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e - dynamic signal, weight 0.80, confidence 0.90
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.MS (rule Virus:Win32/Viking.MS) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.FPMF (rule Trojan.Agent.FPMF) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.xe (rule Virus.Win32.Lamer.xe) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 35 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://perfetto.dev/docs/contributing/getting-started#community - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

55835 behavior events · 2 ATT&CK techniques · 66 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/9275/files/224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e - 224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e
/opt/CAPEv2/storage/analyses/9275/files/089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5 - 089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5
/opt/CAPEv2/storage/analyses/9275/files/645e84f031f2cdd623bb342fa256fe2bb64d4ce4688f0c11a530b602fcbf1db3 - 645e84f031f2cdd623bb342fa256fe2bb64d4ce4688f0c11a530b602fcbf1db3
/opt/CAPEv2/storage/analyses/9275/files/d63702fe0bd5bf7e5cafddd58349a625036e9b70e78d6d80d1d6a897b9dbad28 - d63702fe0bd5bf7e5cafddd58349a625036e9b70e78d6d80d1d6a897b9dbad28
/opt/CAPEv2/storage/analyses/9275/files/0e30c51ac086b6b5dae2ae7039af88c090316805aa0927ab4e2f007895f3841f - 0e30c51ac086b6b5dae2ae7039af88c090316805aa0927ab4e2f007895f3841f
/opt/CAPEv2/storage/analyses/9275/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/9275/files/4b4aff4267767008ed9c511c369a6e01000452e5d8e2330d95689af0e35f8756 - 4b4aff4267767008ed9c511c369a6e01000452e5d8e2330d95689af0e35f8756
/opt/CAPEv2/storage/analyses/9275/files/af2eacdc5171455ac8df56f669fdede4c190d29b3ba4439ec541beda490d28eb - af2eacdc5171455ac8df56f669fdede4c190d29b3ba4439ec541beda490d28eb
/opt/CAPEv2/storage/analyses/9275/files/821183c2603bd5e6b268762844a45925764da6ec051dcb69a148dc0327cf8aeb - 821183c2603bd5e6b268762844a45925764da6ec051dcb69a148dc0327cf8aeb
/opt/CAPEv2/storage/analyses/9275/files/bcce98670e14be492001f9eaa24bdbc79542e3a0a0a306e9606dc8de1be3f510 - bcce98670e14be492001f9eaa24bdbc79542e3a0a0a306e9606dc8de1be3f510
/opt/CAPEv2/storage/analyses/9275/files/13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a - 13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a
/opt/CAPEv2/storage/analyses/9275/files/c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc - c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc
/opt/CAPEv2/storage/analyses/9275/files/af4c1d1de549cc7999310c4ee9fc5d8ba03e3c29b522ee0a3ebf9fe548bfde98 - af4c1d1de549cc7999310c4ee9fc5d8ba03e3c29b522ee0a3ebf9fe548bfde98
/opt/CAPEv2/storage/analyses/9275/files/0d314ba4c190c9b47945aa09bcf9d37d407f16b94944e5669dcd79245bcd935b - 0d314ba4c190c9b47945aa09bcf9d37d407f16b94944e5669dcd79245bcd935b
/opt/CAPEv2/storage/analyses/9275/files/af9809d2f5f78db7e5bbe36497225f46a820f773710aa2beca4282669f360e73 - af9809d2f5f78db7e5bbe36497225f46a820f773710aa2beca4282669f360e73

Embedded URLs

https://perfetto.dev/docs/contributing/getting-started#community
https://www.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786401609&P2=404&P3=2&P4=RRIOvt7vKzLfP5sE2EIy5bsIggZE7MGmM%2fot7uWW1SwS8LYwvnrXghuXk5sY6qijtjhY%2buu%2fsPl%2fKi1QMjulJg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786401622&P2=404&P3=2&P4=TpMG36QM%2bjZaP9DUM4PYhGSGGfm5e7GwoBYDsYHce7gRMRBqBEMseDhyq%2bdMeaBCqqSIbEJIyXYz4%2feyuTlr2Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

openssl.org
mutex.cc
field.cc
time.cc
utils.cc
rds.descriptor.name
descriptor.name
perfetto.dev
regex.cc
allocator.cc
executor.cc
parser.cc
blink.net
registry.cc
thread.cc
sequence.cc
values.cc
mem.cc
regexp.cc
re2.cc
tostring.cc
simplify.cc
parse.cc
onepass.cc
nfa.cc

Embedded IP addresses

192.168.0.30
192.168.8.1
51.132.193.104
4.230.171.124
20.42.179.204
20.247.184.142
74.179.71.159
135.232.92.137
135.232.92.97
4.150.223.102
57.155.101.212
4.247.188.233
203.26.79.13
172.178.240.161
52.110.12.55
52.110.12.10
4.150.223.106
72.153.5.136
92.223.78.30
52.148.114.188
52.110.12.45
52.110.12.25

More Viking samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report