MALICIOUS — 8d80a1f9eb5069e0f024d93fad575b483d0094e704ad447f19692da0f4332dec

MALICIOUS — 8d80a1f9eb5069e0f024d93fad575b483d0094e704ad447f19692da0f4332dec is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Botgor family. 5 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 8d80a1f9eb5069e0f024d93fad575b483d0094e704ad447f19692da0f4332dec
• SHA-1: cccc7290d9007b8fd90b2edff21b42c11f050b9b
• MD5: 2a4f6a917236951e25ee55a34dc995de
• imphash: 09b48ab8c8c83b0e275223a7cfe6ccfd
• ssdeep: 1536:B+gisi/OTW1bk3FwErVvHcTavWyu0uZp2+9GBignpwLsO9NXw6dcixrW:BIZ1bk1FVvHcTavWy4ZobO4O9fcixr
• TLSH: T1D83D49FD6A262260F4F28B0988504DDD8CE2946A11AE041D86C3CF6F5BF9CEB44F9351
• Submitted as: 8d80a1f9eb5069e0f024d93fad575b483d0094e704ad447f19692da0f4332dec
• File type: pe · Size: 130000 bytes
• Verdict: malicious (99/100) · Family: Botgor

Detections (5 of 56 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• ClamAV (daily): Win.Malware.Botgor-9853222-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Emsisoft (Emergency Kit): Trojan.Agent.DYJC
• Trellix Stinger (McAfee): Trojan-FRCT!2A4F6A917236

MITRE ATT&CK

• T1055

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Win.Malware.Botgor-9853222-0 (rule Win.Malware.Botgor-9853222-0) - engine signal, weight 0.90, confidence 0.95
• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• Emsisoft (Emergency Kit) flagged Trojan.Agent.DYJC (rule Trojan.Agent.DYJC) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Trojan-FRCT!2A4F6A917236 (rule Trojan-FRCT!2A4F6A917236) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://www.autoitscript.com/autoit3/ - static signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• licensing.mp.microsoft.com
• config.edge.skype.com
• settings-win.data.microsoft.com
• windows.msn.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• assets.msn.com
• www.bing.com
• th.bing.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Embedded URLs

• http://www.autoitscript.com/autoit3/
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• www.autoitscript.com

Embedded IP addresses

• 20.42.65.90
• 52.230.60.54
• 48.211.4.16
• 4.230.171.124
• 172.64.154.167
• 52.110.12.2
• 52.110.12.25

File paths

• C:\MyRep.dat

More Botgor samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report