MALICIOUS — 90fd93c66653e1a0615306511a39d1891069e68a3bd55de98e63d797b5813786

MALICIOUS — 90fd93c66653e1a0615306511a39d1891069e68a3bd55de98e63d797b5813786 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Fileinfector family. 4 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 90fd93c66653e1a0615306511a39d1891069e68a3bd55de98e63d797b5813786
SHA-1: ceba10b48d870f42ee50f8d8730024b28f1e617d
MD5: f0e355060c31ee7f380ec616e3c80606
imphash: a9192bab5c7c795c7488b69a1853f9c2
ssdeep: 6144:MZAW57ZAW57ZAW5Q57ZAW57ZAW5Q5k+W2Y/:Mm8m8m7m8mk+W2Y/
TLSH: T1E5470ED531807750EDB4F8199D04AC2CB262DDA622363BD86802D47F74B97F706E982E
Submitted as: 90fd93c66653e1a0615306511a39d1891069e68a3bd55de98e63d797b5813786
File type: pe · Size: 341270 bytes
Verdict: malicious (99/100) · Family: Fileinfector

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Fileinfector-9831963-0
Microsoft Defender: Trojan:Win32/CryptInject!pz
Trellix Stinger (McAfee): Trojan-FUFL!F0E355060C31
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Fileinfector-9831963-0 (rule Win.Malware.Fileinfector-9831963-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Terminates Browser, Office or Security Processes [medium] (rule tl-process-kill) - dynamic signal, weight 0.40, confidence 0.90
Contacted 52 external host(s) at runtime (28 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.pinkworld.com, http://www.youporn.com, http://www.redtube.com - static signal, weight 0.35, confidence 0.60
Dropped 15 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

74431 behavior events · 2 ATT&CK techniques · 28 dropped files.

Dropped files

C:\Windows\WindowsUpdate.log - 74e4a486cb99ac584ae7eb151f7a23465481e01d11667709b91cb9fce3185f7e
C:\Windows\System32\msvcp140.dll - 8390f3bc3e1762c4bc895174fe4c19615b178a1f837b6a7edc8d758edbe0bfc0
C:\Windows\System32\msvcp140_1.dll - c87303eee7fa5f867e33892dd4c2f5e1c68e2b0c2c017ac43f1071f8307a6e24
C:\Windows\System32\PrintConfig.dll - 99d4d08fb8449c3f6f6c9a25067c66c37198d3a5ed0318aa1c9cb7d25b8fe489
C:\Windows\setupact.log - a13362e36f31bd3a1f6c2881dfbbeeb76b8a1f3900e927bcefe632a2e912217c
C:\Windows\System32\vcruntime140.dll - 404e175c03fca28488fb31e1e6d79602ac392f9763c51a996b7b3323a28bd4cf
C:\Windows\setuperr.log - eb6c46d18db562ca7eb0f2f71163c5c050fd8a348372cd8178e2dcba4c559639
C:\Windows\System32\vccorlib140.dll - d6dca9edfdce537428895c6130139ef7f2867006ce3900da754278de0e75ce5d
C:\Windows\System32\msvcp140_2.dll - f1e21ddbc6f7838e07c7d0cc1d452ed93338372db20d88f7b01eed463a75ff24
C:\Windows\System32\mmc.exe.config - d2327840b3ab72ddb35fe05c433e124a69fda19eb929eef706eccdbdccd1115f
C:\Windows\Professional.xml - f907de64f753778ac9a8be4247b4cdb84f403f5d716f974d69b16616e282d4ae
C:\Windows\System32\license.rtf - 0c456e6f799b8b9dacfd99e568e53a6fdca4c958721e50c0b1d527aebf145edd
C:\Windows\System32\concrt140.dll - 4b685dd89f3aa8ed0d47d87f45ca0e7db2c9b85e13560f2670baa37ebe7450db
C:\Windows\system.ini - 84fcea8e434f1975e15d799d9b1ae40eb8d81008ac9d55cee3a8f226344486e1
C:\Windows\win.ini - 6be0a2bb75e61dae232e2be61bb3536ac845622607fdd53b196131e94d8dbe7b

Embedded URLs

http://www.pinkworld.com
http://www.youporn.com
http://www.redtube.com
http://www.assparade.com/
http://www.freeav.com/
http://www.antispyware.com/
http://www.antivirus.com/
http://www.ticrf.org.tw/chinese/html/06-rating-1.htm
http://www.ticrf.org.tw/chinese/html/06-rating-v11.htm
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787912173&P2=404&P3=2&P4=lo0ez5b61Nw658k5CcMcoinvpoJTLePl%2fsaI9HzAsIoU992TYeMMJmKIB%2f5zUqqyU%2bgbYbjZkYLz0iPm2ts2Cg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787912230&P2=404&P3=2&P4=AL8e6nrBUdmsnkVoLVQOiPoi%2blsEJgguxsXILdc%2biHYwY85Uo7RPda2s4b1%2bPMLKMz9s33umYe4zTnseBLbRag%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.pinkworld.com
www.youporn.com
www.redtube.com
www.assparade.com
www.freeav.com
www.antispyware.com
www.antivirus.com
www.ticrf.org.tw
www.avira.com
script.crazyegg.com
nexus.ensighten.com
assets.adobedtm.com
t.nc0.co
www.webassetscdn.com
doh.cq0.co
s.go-mpulse.net
widget.trustpilot.com
data.privacy.ensighten.com
dpm.demdex.net
symantec.demdex.net
symantec.tt.omtrdc.net
mhubc.avira.com
www.nortonlifelock.com
rmbyy5ra.avira.com
oms.avira.com

Embedded IP addresses

4.150.223.113
52.123.252.246
4.230.171.124
40.84.97.4
20.247.185.124
135.232.92.137
74.178.76.54
51.11.192.50
74.179.77.204
20.76.201.171
52.123.128.14
52.123.129.14
40.99.134.2
135.234.160.245
203.26.79.13
162.159.142.9
52.123.252.202
74.178.76.44
52.148.114.188
52.123.252.212
40.115.75.193
52.58.28.12
92.223.78.30
108.158.32.67
13.55.4.2

More Fileinfector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report