MALICIOUS — 8d91cf861334329ee826d57dc52dc3594fe9f2d08fd358cbad15dbf72e438047

MALICIOUS — 8d91cf861334329ee826d57dc52dc3594fe9f2d08fd358cbad15dbf72e438047 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 5 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 8d91cf861334329ee826d57dc52dc3594fe9f2d08fd358cbad15dbf72e438047
SHA-1: d5cb7cc1b9be556fecd0daebbea95f481e53e5d4
MD5: 55ef14391e8ec7222c1fea0d4c15222d
imphash: dbf687d6aa2a6cafe4349f7b0821a792
ssdeep: 12288:H1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0pA9AVYUVomkn7wcg6:H1/aGLDCM4D8ayGMmH
TLSH: T1344C293F1168BBAAD922C0E9C51C2A1C8496F85D24B68788DE57B11DC2D53F311F31BA
Submitted as: 8d91cf861334329ee826d57dc52dc3594fe9f2d08fd358cbad15dbf72e438047
File type: pe · Size: 563193 bytes
Verdict: malicious (99/100)

Detections (5 of 55 engines)

ClamAV (daily): Win.Trojan.Agent-1388655
Microsoft Defender: Trojan:Win32/Mira!pz
Emsisoft (Emergency Kit): Generic.Mira.03E12B01
Trellix Stinger (McAfee): W32/Worm-FUC!55EF14391E8E
Kaspersky (KVRT): Trojan.Win32.Agent.icgh

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-1388655 (rule Win.Trojan.Agent-1388655) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Dropped a suspicious payload (Persistence): scoobe-fix.cmd - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75

Dynamic analysis (windows)

5867 behavior events · 1 ATT&CK techniques · 33 dropped files.

Dropped files

C:\DumpStack.log.tmp .exe - 1c2fced449dc3b5bd7669fffd538e53985c215572aceaa1e636e8c70bc583a14
C:\p.ps1 .exe - c936d2778ad13698f2e7a1901be92d177deeec4ebf52f287947d405c3639d904
C:\swapfile.sys .exe - 1b6cd6b438ef7779b171241b21bf1a064529fc4fc68bb260f10e619f3f2d314e
C:\800.ini - 92b1d7b25ade31a55383f03c5649d6d20aaddaf9c42f5b73d61c2c47634dfef6
C:\Users .exe - 50f4c1a16bcd6d48d36ac40bbab2c19b6483af2e6d6cb27a168b7d3ceca891bc
C:\inetpub .exe - 5124b0b5406419226ecd4f1d0209d743cd0ac8f8999bc67448c539f837597f7d
C:\uac-done.txt - ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a
C:\Program Files (x86) .exe - 9b42bf1f2709187dd70bcfdd9bc6c70db69d631870d376362ab9736ff88a1da0
C:\pagefile.sys .exe - 1bd3dffc72dc4547ff5d2c1bd731691b5feb9fe438dbc3c7cdd2c977906d0c18
C:\uac.ps1 .exe - b8f5a540607fc8d8c69b16c63abdcea7da7803185b29833750e6b632dedddce9
C:\ProgramData\elopx.exe - 1a578c970f7243abc6dd0b235516aa6f7dec35b1390becb51e5bca7cfb1c2684
C:\800.ini .exe - 0a87c382f8fd561ec2506a98d557f33de9ebb398fd80cbc0bbeafc3662b025d5
C:\Program Files .exe - f7cf441fbb653b527388b55939241e2065ae457ed01265a3b0a918408fc98ec3
C:\uac-done.txt .exe - cf3ef1ea1a618697882cb679495d01b9bd8ef87d2b4861e7af361c59588c4425
C:\ProgramData\Saaaalamm\Mira.h - dcde44fe00bc7201e37d74f15f1920fff3e38e85431683f7040c50f1ee8ff155

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787802665&P2=404&P3=2&P4=TaEYKpjrUgHs%2bkR3x0FEm5sVI%2fZ7ORvlN9yiKCrbhzUjBa1sJTGIk4luaSovRmRnnqZyxz0SjvbDc391HHTmYQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787802745&P2=404&P3=2&P4=nhac1MdpfW8G7xu5lfuaYy0rEWd7OezAHOXHq83D8ZJjt79MIwSBms2E1Vb06QCoUzwDftdspBK78bgceTgsVw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

4.150.223.113
20.247.184.197
85.210.193.152
74.178.240.61
135.233.95.135
4.150.223.109
52.123.129.14
20.76.201.171
52.123.128.14
4.150.223.101
52.123.252.226
135.233.45.222
4.230.171.124
203.26.79.13
162.159.142.9
52.110.12.21
52.110.12.40
52.148.114.188
74.179.71.159
20.184.175.21
20.42.72.131
72.145.35.110
135.233.95.80
52.110.12.25

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report