MALICIOUS — 9034b6fd6e82213bce816413721ba4edd71c4bc31a899733e561ab9eee054579
MALICIOUS — 9034b6fd6e82213bce816413721ba4edd71c4bc31a899733e561ab9eee054579 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Shodi family. 5 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
9034b6fd6e82213bce816413721ba4edd71c4bc31a899733e561ab9eee054579 - SHA-1:
ed82bb1051f6f708645578f4d5eba9958f5b30fb - MD5:
9c17cdfca7ee404ff3766b7247b708c3 - imphash:
77f13bc24efea5a05601b43cf44d1f1a - ssdeep:
49152:iwDTqrVwDTqrewDTqrewDTqrewDTqrewDTqr9wDTqr9wDTqrewDTqrewDTqrkwD:RfYYYYPPYYuYY - TLSH:
T17860AE5563235261F1F7CDA1AC90CD9C40B3B4FA20B6598D9283E89E78F5C73D4722A8 - Submitted as: 9034b6fd6e82213bce816413721ba4edd71c4bc31a899733e561ab9eee054579
- File type: pe · Size: 3721757 bytes
- Verdict: malicious (99/100) · Family: Shodi
Detections (5 of 56 engines)
- ClamAV (daily): Win.Trojan.FuBu-1
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Virus:Win32/Shodi
- Emsisoft (Emergency Kit): Win32.HLLP.Shodi.A
- Kaspersky (KVRT): Virus.Win32.HLLP.Shodi.a
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 8 weighted signals:
- ClamAV (daily) flagged Win.Trojan.FuBu-1 (rule
Win.Trojan.FuBu-1) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Virus:Win32/Shodi (rule
Virus:Win32/Shodi) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Win32.HLLP.Shodi.A (rule
Win32.HLLP.Shodi.A) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Virus.Win32.HLLP.Shodi.a (rule
Virus.Win32.HLLP.Shodi.a) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Contacted 1 external host(s) and 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Dropped 12 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
8804 behavior events · 0 ATT&CK techniques · 25 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- desktop-hsgcbep
- login.live.com
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
Dropped files
- C:\Windows\System32\UsaShohdi.asu -
ea17f4d29cf724b37ad20d32677a4098eb21e80241b3764ac0901d50b501d9f6 - C:\Program Files\7-Zip\Uninstall.exe -
1ab9197caf2dcc2ce7028cb98beafe701ca77ba5bc6a94f2edd0c0475929d854 - C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.usa -
79671bf6759f645dfeb021e3fcece87abe20b7c6be7ee7bf9c362603056a23ee - C:\Program Files\7-Zip\7zFM.exe -
5e3e031de54b3330f1ef6d830ee0de984d78d1bc33ac5cf55d88397074a49270 - C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.usa -
7ab807b2f85d1de86a4ddbdc9efffe045c74d75668f9e7428999e863a062507b - C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe -
053d20eb1d8d2f22fbcfe0957893025d976ee517a8eb60d3f2abd6802169a86b - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.usa -
c82577476eb3c66d0e8e4e1c57c1cb88e453d988bd7cbc41abd5faa1449b30ca - C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.usa -
ac57673f2caf4d337e22c1bddee94aa35db245b1f4701356c73da34731ca1fa0 - C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe -
8a1726d45947a2f7414e84e8d6012562324306967d1f8afe48bcce9cc24c7045 - C:\Program Files\7-Zip\7zG.exe -
990e2bd88c762aae6286c95c3c01b52626739bda2ea17c70d5661422f441c87e - C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.usa -
ae2a000af454e8c936e325f88105268855dd266252d50ce2be3eac66b1e57c7e - C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe -
065bf8589118f7a15b97cf2649059000d7a53b94c0ce068c454cae2a07cecd48 - C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe -
7e7b1a6d4684ed220d7ca728f4a7518cf4a09e1c47cc24c1e2355892651f9177 - C:\Program Files\7-Zip\7zG.usa -
7b5eda73c21960c451ea3148900b28cdbac7180e43047fbc944028096e497c08 - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe -
fcd7ea3fc9e7cf41c8038102700416dfd5241a9e17b2af0b150fb2139a87d8e0
Embedded URLs
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
- http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
- http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
- http://yr.c.lencr.org/
Embedded domains
- www.microsoft.com
- crl.microsoft.com
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 51.105.71.136
- 52.123.252.224
- 4.230.171.124
- 57.155.104.224
- 4.144.132.114
- 135.232.92.137
- 20.165.94.54
- 20.184.175.15
- 104.18.33.89
- 52.110.12.49
- 52.110.12.46
- 125.56.205.24
- 125.56.205.17
- 20.42.179.204
- 20.184.175.6
- 4.207.44.75
- 72.154.7.17
- 52.148.114.188
- 52.110.12.56
More Shodi samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report