MALICIOUS — 8d6c34f02c290895ad5dc5dbdf1dfe2366bce99b5be93cb8d022e78994012c3b

MALICIOUS — 8d6c34f02c290895ad5dc5dbdf1dfe2366bce99b5be93cb8d022e78994012c3b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Crypted family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 8d6c34f02c290895ad5dc5dbdf1dfe2366bce99b5be93cb8d022e78994012c3b
SHA-1: 25859585ded5a32149a63c5816007c2dc4e5742d
MD5: e90be95c0c433c60dec51f506f4b8a1f
imphash: 62ec3dce1eba1b68f6a4511bb09f8c2c
ssdeep: 12288:itJ37uq1V0DdS0UV0DdA/ZAV0DdS0UV0Dd:i37udDdt/DdY1Ddt/Dd
TLSH: T1744A3A1395985B27CEE9D767C286B8EF86F1152DECE567F0970361D3200EC8BA400E69
Submitted as: 8d6c34f02c290895ad5dc5dbdf1dfe2366bce99b5be93cb8d022e78994012c3b
File type: pe · Size: 450560 bytes
Verdict: malicious (99/100) · Family: Crypted

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Crypted-30
Microsoft Defender: Backdoor:Win32/Berbew.AA!MTB
Emsisoft (Emergency Kit): GenPack:Generic.Dacic.1.Backdoor.Hangup.A.004BF035
Trellix Stinger (McAfee): Trojan-FUGH!E90BE95C0C43
Kaspersky (KVRT): Trojan-Proxy.Win32.Qukart.vih

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Trojan.Crypted-30 (rule Win.Trojan.Crypted-30) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Backdoor:Win32/Berbew.AA!MTB (rule Backdoor:Win32/Berbew.AA!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged GenPack:Generic.Dacic.1.Backdoor.Hangup.A.004BF035 (rule GenPack:Generic.Dacic.1.Backdoor.Hangup.A.004BF035) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FUGH!E90BE95C0C43 (rule Trojan-FUGH!E90BE95C0C43) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Proxy.Win32.Qukart.vih (rule Trojan-Proxy.Win32.Qukart.vih) - engine signal, weight 0.55, confidence 0.85
Contacted 2 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Dropped 98 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

3157 behavior events · 1 ATT&CK techniques · 98 dropped files.

Dropped files

C:\Windows\System32\Gopkndgq.exe - 13080d69c05cf2b8d276f8848fd55bdcfba12460a45a8a66b9ae72a8a1c9a3a5
C:\Windows\System32\Hlhfplcn.exe - 3c291206e5a3055f963499ea3a4a4a1fde49a810f1117656ca1a91375245c177
C:\Windows\System32\Ldoqfpck.exe - ebce2ad17e3be45e998b2dd23902a34dba66386cd24d5685a90c52b223a9e3af
C:\Windows\System32\Kjhplmhk.exe - 74968bb3ebdcc8b47ddcd764ab8e95d9f0428aef17d0086d1a594d5f40dc1633
C:\Windows\System32\Cnblclkf.dll - 4eb1843cc90cadd820091cdfd9b1b6c6a474e775af85448cba5fc951d9ea5ead
C:\Windows\System32\Ghfdonam.exe - cc83421dc3b580ff8d424994657f0f68c325069c23d23c0f17034ddebde44d71
C:\Windows\System32\Hjejok32.exe - bf97e23fc141307a4e27a17065eb269e08bd3c9a9eb720b838c67e2073897518
C:\Windows\System32\Ojoddl32.dll - 6f276b6a9826c15b3bcc349e6012b0fd5ba96c6f2a80e180aa912fa94c35690b
C:\Windows\System32\Obpokebd.dll - 663efd6d1a0a36d7cbe9684d348ec6dcb36710b0624ff8effde9aaf855f872c4
C:\Windows\System32\Bcnicaci.exe - 24e51dd4f94bb963e926ba6b4cc6a9bcc2d5ee9ef3a6d82355e5db5034f5fe4a
C:\Windows\System32\Pecmpbbf.dll - c1f97835e1b69b7cf0c81c5519ebb798d9f4f303d87105b0613f4986c747c289
C:\Windows\System32\Gbioidac.dll - 36ce4eb9e0fc685019d57b96e3c7ca2a8a994c518db7da0743572045485d231d
C:\Windows\System32\Hgeokbck.exe - 120c1adcfa6c53d0681350bca50481fc0d81404d11dd3cd1fd3979ab5230d600
C:\Windows\System32\Emmdeeok.dll - ddf122059ddba12adb58386b247f41f1884c11c66827a94f01fd47772c8fa3f4
C:\Windows\System32\Eladcfdf.dll - c91f7090f830c189ba8b0a7cb400aa84ab187279d454c722e76e5f1cfad8fadd

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.117.171
4.230.171.124
4.247.188.233
52.230.59.222
20.165.94.63
20.165.94.54
4.150.223.108
52.182.143.212
104.18.33.89
74.179.77.204
4.150.223.100
51.116.246.104
52.110.12.25
52.110.12.52
92.223.78.30
52.148.114.188
135.233.45.221
72.145.35.104
52.110.12.48
52.110.12.24

More Crypted samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report