MALICIOUS — 94c8f99aca83fff4ca5340162987e609171bfb1a52799d8f679b2fe044fd16fd

MALICIOUS — 94c8f99aca83fff4ca5340162987e609171bfb1a52799d8f679b2fe044fd16fd is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Mikey family. 7 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 94c8f99aca83fff4ca5340162987e609171bfb1a52799d8f679b2fe044fd16fd
SHA-1: afdd3adc8f2b6e3b720286a53fc47af7e47702d2
MD5: 8fc0fc48541101a7ef0e2f56b1d18282
imphash: 09d0478591d4f788cb3e5ea416c25237
ssdeep: 6144:NKLOgsgomKLEFESGz0SPpeEPkPDPrzgtRY5RdrHc13FG9ItU6GvPwg:AOgwmisETzuaeDPvjJ81VGqK6GvPv
TLSH: T1DF4BD099C2F2A7C9DAF39370AD20824D20D25CDAE07F8CD85F83D156A2D1C9BD1E115A
Submitted as: 94c8f99aca83fff4ca5340162987e609171bfb1a52799d8f679b2fe044fd16fd
File type: pe · Size: 477928 bytes
Verdict: malicious (100/100) · Family: Mikey

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
ClamAV (daily): Win.Packed.Mikey-9645700-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Urelas!pz
Emsisoft (Emergency Kit): Gen:Heur.Mint.SP.Urelas.1
Kaspersky (KVRT): UDS:Backdoor.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Packed.Mikey-9645700-0 (rule Win.Packed.Mikey-9645700-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Urelas!pz (rule Trojan:Win32/Urelas!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Mint.SP.Urelas.1 (rule Gen:Heur.Mint.SP.Urelas.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Backdoor.Win32.Generic (rule UDS:Backdoor.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Microsoft Linker (rule Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 1.234.83.146, 133.242.129.155, 218.54.31.226 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

12587 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\uzsab.exe - e34b78392e2e2e55011029634c7f34ea8f00f9610913d619f7094dd1e4436b75
C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - 4e073e71d5952dcc6a8c7d3db9384884af8a2ea7b1940d941aab547306443e1a
5401ab6ca4b27970f6e562f820a6f2618e670bf9771b6db3cdebc3a3f736899e - 5401ab6ca4b27970f6e562f820a6f2618e670bf9771b6db3cdebc3a3f736899e

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

1.234.83.146
133.242.129.155
218.54.31.226
20.184.175.6
52.123.252.231
4.230.171.124
4.247.188.233
52.230.60.54
135.232.92.97
74.178.240.61
4.207.44.72
51.132.193.104
74.178.76.128
218.54.31.165
135.233.45.221
72.145.35.108
52.148.114.188
52.110.12.30
52.110.12.33

More Mikey samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report