MALICIOUS — 8e4b43ac018b9d68fd78a593c45855957664495ac4ff33384dfa6090cdb69ba8

MALICIOUS — 8e4b43ac018b9d68fd78a593c45855957664495ac4ff33384dfa6090cdb69ba8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Glupteba family. 3 of 56 detection engines flagged it.

Identification

• SHA-256: 8e4b43ac018b9d68fd78a593c45855957664495ac4ff33384dfa6090cdb69ba8
• SHA-1: b8bae83dda2a40df13f970f6dbb4981a554b0424
• MD5: 44dbc00d9da23855ee9585b388938a60
• imphash: d41d8cd98f00b204e9800998ecf8427e
• ssdeep: 12288:/I9BZ2XDa7l0PMZjtUuoobP4TFEmmea9DAgtBrpmrlSMEGogmnCQXHwH7D0j:/nIl/teobPoFEmmeaBFbrpmrlSVCgHwK
• TLSH: T1794CF11C37743EF0D90D960B1A6144DC5AA7DDA824BE2132AB60222E435F3B7993D79C
• Submitted as: 8e4b43ac018b9d68fd78a593c45855957664495ac4ff33384dfa6090cdb69ba8
• File type: pe · Size: 518145 bytes
• Verdict: malicious (96/100) · Family: Glupteba

Detections (3 of 56 engines)

• Microsoft Defender: Trojan:Win32/Copak.C!MTB
• Trellix Stinger (McAfee): Glupteba-FTTQ!44DBC00D9DA2
• Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

Why this verdict

The malicious score of 96/100 is the fusion of 6 weighted signals:

• Memory forensics: 2 finding(s) attributed to the sample across 2 technique(s), e.g. process hollowing in tsk_2934c5edd6 (pid 5464) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.75, confidence 0.85
• Microsoft Defender flagged Trojan:Win32/Copak.C!MTB (rule Trojan:Win32/Copak.C!MTB) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Glupteba-FTTQ!44DBC00D9DA2 (rule Glupteba-FTTQ!44DBC00D9DA2) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
• Contacted 1 external host(s) and 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

3703 behavior events · 0 ATT&CK techniques · 5 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• www.JDswUgedA2.com
• ctldl.windowsupdate.com
• update.googleapis.com
• desktop-hsgcbep
• login.live.com
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• assets.msn.com
• settings-win.data.microsoft.com
• www.bing.com
• fe3cr.delivery.mp.microsoft.com
• licensing.mp.microsoft.com

Dropped files

• 1417ea1f9f44a91bb0b44de6e15207432060db20b4f6e5c46106373d7682c328 - 1417ea1f9f44a91bb0b44de6e15207432060db20b4f6e5c46106373d7682c328
• a7cc345c954362664e2780fafc39607d240613e672fb0e22a63b26fdc0e936e5 - a7cc345c954362664e2780fafc39607d240613e672fb0e22a63b26fdc0e936e5
• cf64393bc438875a80e509b5e3aea31464d93d9a8b0575455e00430d40ab802b - cf64393bc438875a80e509b5e3aea31464d93d9a8b0575455e00430d40ab802b
• ee7b81f227de109c4a8870c57952b6e4f06d5c7d49e23474d03949c53bc9db74 - ee7b81f227de109c4a8870c57952b6e4f06d5c7d49e23474d03949c53bc9db74
• 799054f2f4b7bbc22e3308c40725e07b0aeee04e21d9efcddc15a29dd329961f - 799054f2f4b7bbc22e3308c40725e07b0aeee04e21d9efcddc15a29dd329961f

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788055550&P2=404&P3=2&P4=P8E7S3%2b6EbPK8gsjF6P6DEClkp4zxTnjOn16ha3rJxga75owfi3JHbzLAdze4Ge4taC61yC3tZ%2bGNuV0ATdQ%2fA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

• www.jdswugeda2.com

Embedded IP addresses

• 20.42.65.89
• 52.123.252.192
• 4.230.171.124
• 40.84.85.40
• 135.232.92.97
• 20.247.184.142
• 20.42.65.88
• 74.178.76.128
• 52.123.252.231
• 135.232.92.34
• 203.26.79.13
• 135.233.95.144
• 92.223.78.30
• 72.154.7.106
• 20.42.73.26
• 57.154.63.210
• 52.148.114.188
• 52.110.12.52
• 52.110.12.20

More Glupteba samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report