MALICIOUS — 908cf7cd18b138f4f6c42f73510a68e0b407b7c4e6bcb1b7d7e9db99a8fffa25

MALICIOUS — 908cf7cd18b138f4f6c42f73510a68e0b407b7c4e6bcb1b7d7e9db99a8fffa25 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Barys family. 7 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 908cf7cd18b138f4f6c42f73510a68e0b407b7c4e6bcb1b7d7e9db99a8fffa25
SHA-1: ec2b66ef6b792083fc94e090c45a15db4afb6c65
MD5: 152d55797c8fbc1e5c8786a2e090b73a
imphash: ac9eb1085b6eee2907a6ad89926cf94d
ssdeep: 768:m7Vcddp9Nkcy1roWSUDBtVa4uvTwnGr/FkvDV:modJctowDfVa4krrN2DV
TLSH: T1FA2EE1AA42DD3EFFC2F21B4621819CBC88108C4D127F1A647151C52AC4E513FE8EE388
Submitted as: 908cf7cd18b138f4f6c42f73510a68e0b407b7c4e6bcb1b7d7e9db99a8fffa25
File type: pe · Size: 30260 bytes
Verdict: malicious (100/100) · Family: Barys

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:CODE
ClamAV (daily): Win.Malware.Barys-9916803-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Variant.Stealer.210
Kaspersky (KVRT): HEUR:Trojan-Downloader.Win32.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Barys-9916803-0 (rule Win.Malware.Barys-9916803-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Vindor!pz (rule Trojan:Win32/Vindor!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Stealer.210 (rule Gen:Variant.Stealer.210) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.Win32.Agent.gen (rule HEUR:Trojan-Downloader.Win32.Agent.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 13 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:CODE (rule high-entropy-sections:CODE) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:CODE, Turbo Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

19598 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

c94190bc87e526ac42ce73ff2afcbf72e8de72afb7cc6ea251ea433853c7b0dc - c94190bc87e526ac42ce73ff2afcbf72e8de72afb7cc6ea251ea433853c7b0dc

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

schemas.microsoft.com
zhibo.baidu581.com

Embedded IP addresses

40.79.167.10
57.155.101.212
4.230.171.124
20.165.94.54
51.116.246.104
74.178.240.61
4.144.132.223
20.165.94.63
4.150.223.108
13.89.179.15
4.195.116.8
20.11.121.11
52.123.252.225
135.234.160.244
52.110.12.46
52.110.12.1
52.148.114.188
72.154.7.98
52.110.12.4
52.110.12.20

More Barys samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report