MALICIOUS — 9463bd5f6df7d7a1c7c0d32f50390796ded9278ba46fc9fc334ecb2c8823518b

MALICIOUS — 9463bd5f6df7d7a1c7c0d32f50390796ded9278ba46fc9fc334ecb2c8823518b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mikey family. 5 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 9463bd5f6df7d7a1c7c0d32f50390796ded9278ba46fc9fc334ecb2c8823518b
SHA-1: 0b2ca7ddae4ecbe17bf15cbb7140594a73146efc
MD5: efc58d570e1d21aa4ae1b512c5d523e2
imphash: a81d47be7ec632950c54b0a0d4722811
ssdeep: 768:s1r8HmK3p9ADfhIPUjg/+zrkEqHWGH1T4CYaoo7AOuCYDOgE4othebMrviLpwUU:g4H3pi5IPUjHzrkEQvTHDdAl4/B342Y
TLSH: T1C2330967F943371EE131DCD4FFDEAEADC4CEBC1A251928489326C241525EA2BD4B1A04
Submitted as: 9463bd5f6df7d7a1c7c0d32f50390796ded9278ba46fc9fc334ecb2c8823518b
File type: pe · Size: 47616 bytes
Verdict: malicious (99/100) · Family: Mikey

Detections (5 of 56 engines)

ClamAV (daily): Win.Malware.Mikey-9941813-0
Microsoft Defender: Trojan:Win32/Tnega!pz
Emsisoft (Emergency Kit): Gen:Variant.Mikey.131389
Trellix Stinger (McAfee): Drixed-FKR!EFC58D570E1D
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

T1071.001

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Mikey-9941813-0 (rule Win.Malware.Mikey-9941813-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Tnega!pz (rule Trojan:Win32/Tnega!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Mikey.131389 (rule Gen:Variant.Mikey.131389) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Drixed-FKR!EFC58D570E1D (rule Drixed-FKR!EFC58D570E1D) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://cdn.discordapp.com/attachments/908705566321422390/909753810732322827/ABbyzCt.mkv, https://cdn.discordapp.com/attachments/908705566321422390/909753813894840320/BYdYBh.mkv, https://cdn.discordapp.com/attachments/908705566321422390/909753817732640768/vVgXoysifBBf.mkv - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Memory forensics: 4 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 5664) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

80 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
update.googleapis.com
login.live.com
desktop-hsgcbep
v20.events.data.microsoft.com
licensing.mp.microsoft.com
config.edge.skype.com
windows.msn.com
www.msn.com
officeclient.microsoft.com
odc.officeapps.live.com
assets.msn.com
www.bing.com
watson.events.data.microsoft.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded URLs

https://cdn.discordapp.com/attachments/908705566321422390/909753810732322827/ABbyzCt.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753813894840320/BYdYBh.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753817732640768/vVgXoysifBBf.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753821796900894/gqFNcmyaVAIU.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753826008002570/dRGiGTmVXpd.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753835877175296/HWGrOg.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753842562924564/qKitPjMlpMMfJRW.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753847159873536/AqAQAtxHmkkF.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753851878449182/JrjVGs.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753856399925248/wxPFjUsBCnmq.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753861567283260/OGvsPWfKC.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753865648373760/MnevgYbLvYX.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753871797202984/JfVhSzwnJx.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753876217991199/OxTrXznsBfGNaY.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753881058217996/TCbInJgPF.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753887190286407/gcdkKU.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753890856120330/orNhyQBJoXqSYp.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753895515987988/UlLhaiGq.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753902319144970/WwZDjDkqyjIJWES.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753906198904832/PuFAKNyD.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753913446649896/drzRhB.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753918454640650/suTMPc.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753923068379146/hicemQ.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753928013463562/GzhRS.mkv
https://cdn.discordapp.com/attachments/908705566321422390/909753933583491102/ADRqd.mkv

Embedded domains

cdn.discordapp.com

Embedded IP addresses

20.184.175.22
20.247.184.142
52.123.252.235
4.230.171.124
20.247.184.197
172.178.240.163
52.110.12.26

File paths

C:\ProgramData\gay_nigger_porn.mkv
C:\Users\user\HelloWorldXll-master\x64\Release\HelloWorldXll.pdb
C:\Windows\System32\

More Mikey samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report