SUSPICIOUS — 8f8844bedb1724fc236cbe6d57bc38a61ba37632b0e5e68d0523b2f9d444e754

SUSPICIOUS — 8f8844bedb1724fc236cbe6d57bc38a61ba37632b0e5e68d0523b2f9d444e754 is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 5 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 8f8844bedb1724fc236cbe6d57bc38a61ba37632b0e5e68d0523b2f9d444e754
SHA-1: 3939ffae940ae8c80f1b50b49879fa737773f9ae
MD5: cbd4ed3b84494cc12b28a3c1a290587a
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 24576:75nBNvlSeIE1ditES5ntn58T3qvLZ9db0Aa:lBHQed4Dl58j
TLSH: T1C5547DA80A492E47EAD3BA866410BB7DDEC2704690731C5B504ACBD33FA86F7D774109
Submitted as: 8f8844bedb1724fc236cbe6d57bc38a61ba37632b0e5e68d0523b2f9d444e754
File type: pe · Size: 1110528 bytes
Verdict: suspicious (54/100)

Detections (5 of 55 engines)

capa (capabilities): capability:execution/powershell
MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
Detect It Easy (packer/type): DIE:Microsoft Linker
Emsisoft (Emergency Kit): IL:Trojan.MSILZilla.46335
Kaspersky (KVRT): UDS:Trojan-Spy.MSIL.Quasar.gen

MITRE ATT&CK

Why this verdict

The suspicious score of 54/100 is the fusion of 9 weighted signals:

Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 27 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 3.18.22.34 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

6417 behavior events · 2 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787906211&P2=404&P3=2&P4=mkMZeUVRQH41GB0KyKBKTsWqgQmRsjXK2dqSaa4uQe8ad1UEINEX41eXu06%2fVF2mxxXXPppc06VxhhW1RVJ7EQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787906336&P2=404&P3=2&P4=FHwPb2j%2fFLiJCdMkHjq4KDI9uy86fvMrqO0GD4%2f0dtht9654Td7e6M0lyjeOkPuSgcbW5iRSSjjq3f%2fB%2f7wuww%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

w.nl

Embedded IP addresses

3.18.22.34
57.154.63.210
20.184.175.5
52.123.252.247
20.247.184.197
4.230.171.124
40.84.85.40
135.233.95.144
20.165.94.54
52.123.129.14
20.112.250.133
40.99.134.18
52.123.128.14
51.132.193.104
52.110.12.53
52.110.12.44
135.233.45.221
52.123.252.236
203.26.79.13
52.148.114.188
135.233.45.223
52.123.252.232
135.233.95.80
92.223.78.30
72.154.7.103

File paths

e:\3J

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report