MALICIOUS — 766_Win32.Caphaw.Shylock.bin

MALICIOUS — 766_Win32.Caphaw.Shylock.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Caphaw family. 4 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 8c213b3707b0b042d769fdf543c6e8bd7c127cea6a9bc989eaf241a1505d1ed9
• SHA-1: 766da148d74f7ea9aca692246a945bd70da6cf18
• MD5: e63fead91fe788dac57601d2c77713f9
• imphash: da7d20c6c2580de4f760d36400684804
• ssdeep: 384:4uOwvhT2H6TecGG3gBbyJrK0+PXmVtqGy1cQEkGt5AgaROz5jLdhkUOk1:4vaT5efUGbCrKTf6jkG+odqxk
• TLSH: T18C2D4A534211B764D0F2CB90A4058C1F18F6B095E8BF5EEA69A1C00F67A7D7B883F624
• Submitted as: 766_Win32.Caphaw.Shylock.bin
• File type: pe · Size: 28032 bytes
• Verdict: malicious (98/100) · Family: Caphaw

Detections (4 of 52 engines)

• capa (capabilities): capability:credential-access
• ClamAV (daily): Win.Trojan.Rootkit-77
• Microsoft Defender: Trojan:WinNT/Caphaw.A
• Emsisoft (Emergency Kit): Trojan.Generic.37693484

MITRE ATT&CK

• T1555
• T1003

Why this verdict

The malicious score of 98/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Rootkit-77 (rule Win.Trojan.Rootkit-77) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:WinNT/Caphaw.A (rule Trojan:WinNT/Caphaw.A) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Generic.37693484 (rule Trojan.Generic.37693484) - engine signal, weight 0.55, confidence 0.85
• access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

File paths

• C:\Windows\System32\

More Caphaw samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report