MALICIOUS — 91b96b9b90bf46dcb9d6dbebf5fabc40a991d0ffb26858436d5b04df21797231

MALICIOUS — 91b96b9b90bf46dcb9d6dbebf5fabc40a991d0ffb26858436d5b04df21797231 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepender family. 7 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 91b96b9b90bf46dcb9d6dbebf5fabc40a991d0ffb26858436d5b04df21797231
SHA-1: 8af15fb2f1b32e4a566c43c71d9945a4cf74fa02
MD5: bd0fa5b9855e2db1e8917d2a503f5b6c
imphash: 5144a995e58e9a1dec8b8e0e5ed55aec
ssdeep: 12288:lIbZWSfgwVS3dLobtzV5Pz3vA0NGIwcw5iIYW:ibawVGaPzfzNjwZZY
TLSH: T156519E33A52B6DAAF23A67E02C61259C40417E1C135D219E778EB1990DFF737132B4A2
Submitted as: 91b96b9b90bf46dcb9d6dbebf5fabc40a991d0ffb26858436d5b04df21797231
File type: pe · Size: 880640 bytes
Verdict: malicious (100/100) · Family: Prepender

Detections (7 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Generic-9907165-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Pidgeon.A
Emsisoft (Emergency Kit): Win32.Prepender.Gen.1
Trellix Stinger (McAfee): Flyagent.d
Kaspersky (KVRT): Virus.Win32.Agent.ev

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 17 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9907165-0 (rule Win.Trojan.Generic-9907165-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Pidgeon.A (rule Virus:Win32/Pidgeon.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Prepender.Gen.1 (rule Win32.Prepender.Gen.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Flyagent.d (rule Flyagent.d) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Agent.ev (rule Virus.Win32.Agent.ev) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
2 behavioral detection(s) across 2 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.43, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.eyuyan.com - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 18 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

68857 behavior events · 2 ATT&CK techniques · 25 dropped files.

Dropped files

C:\Program Files\7-Zip\7zFM.exe - b79e415383138396c920facf7bed7daafab596ccc25a2346e3dbea8e9b70daaa
C:\Program Files\7-Zip\7zG.exe.ico - 8cad493433ec34a34ca6f4fd49655aaf7cbb4337752743804db83ea6c050d1fe
512d72b1853a4c16e584f5cca4a00928c31092bc8ff39f4547e49718ae3099f7 - 512d72b1853a4c16e584f5cca4a00928c31092bc8ff39f4547e49718ae3099f7
C:\Program Files\7-Zip\Uninstall.exe - dae31c7a75c0d33ca227934322b70abb9e3f773a7c02668c484429339bcaa656
C:\Program Files\7-Zip\Uninstall.exe.ico - ea0420b60b078a22fdcfd40d86d589793baa2e0327b37dcdcc5399aac4037d4e
9b4ea15d1aad871930a9f39491207baab995cf1c5c213e75bc309a5a32241eae - 9b4ea15d1aad871930a9f39491207baab995cf1c5c213e75bc309a5a32241eae
C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe.exe - bfc05cdab74641b8aa6ef7b9e679e4062d69226be5f6773e6651b6925c584339
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe - f714f494e272608daaec7d62f63fa319d96053562539b0758258b4f3b7e0fa91
19ae4dc6481f738d164b59daa58659ddc4419911089464415840e7ab31e4bf4b - 19ae4dc6481f738d164b59daa58659ddc4419911089464415840e7ab31e4bf4b
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe - bd9f9a7f6fad6ee3b69a80b01aa9868f99f55c90eb6f6ddc8103e8ea614ba8ff
C:\Program Files\7-Zip\7z.exe - a3bc64d75b003bb428770cc37723dfccfe3a98650e493f4d370dfb6d5b4456f2
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe.exe - 4544577b956beafac478f8bbfad4024aa2766a3d1aeb44bcd55a885b8e1134e9
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe.ico - 14b347748c4d208fa5294f7bdd53ae4147d40e27cf810dd60423af0d8b0c989c
C:\Program Files\7-Zip\7zG.exe - c284c6c406dce05f5e1801c6e0744c6ee69cc18bdc8867ba3cfa05b669c5aa54
C:\Program Files\7-Zip\Uninstall.exe.exe - 978232758546933cdbd609537ad3771424f002e6cec018a4c866c87093f8aa22

Embedded URLs

http://www.eyuyan.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.eyuyan.com
wtqq.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.101
52.123.252.223
4.230.171.124
57.154.63.210
4.144.132.223
20.165.94.54
20.184.175.9
74.178.76.128
135.232.92.137
104.18.33.89
135.234.160.245
172.215.188.225
20.42.72.131
4.150.223.111
72.153.5.135
92.223.78.30
52.110.12.10
52.148.114.188
52.110.12.44

More Prepender samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report