CLEAN — 958c78cf3426728c34244ab6db220c0d2f174c203aaecc8e040b0d9c59d86be9

CLEAN — 958c78cf3426728c34244ab6db220c0d2f174c203aaecc8e040b0d9c59d86be9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a clean verdict (0/100). 4 of 55 detection engines flagged it.

Identification

• SHA-256: 958c78cf3426728c34244ab6db220c0d2f174c203aaecc8e040b0d9c59d86be9
• SHA-1: abc19f2c55c5f0253d48a90c61c0841f2e3d49c8
• MD5: f3d6bbd184ba99aabbd7741c18d889f6
• imphash: d41d8cd98f00b204e9800998ecf8427e
• ssdeep: 1536:toWG+CHC61ZZ9VEDQz4Rb6l7zSYboPVh43mg5OiqTTMT/ufuc:mWGfBYK4BXYbI43mJ/Y/cuc
• TLSH: T1A839C0109E22F781F69FE57A5A76470DB25983CC2072CA7547C8383058B2AFF429E643
• Submitted as: 958c78cf3426728c34244ab6db220c0d2f174c203aaecc8e040b0d9c59d86be9
• File type: pe · Size: 84480 bytes
• Verdict: clean (0/100)

Detections (4 of 55 engines)

• Microsoft Defender: Trojan:Win32/Glupteba!pz
• Emsisoft (Emergency Kit): Gen:Trojan.Heur.fuW@IHo3wXi
• Trellix Stinger (McAfee): Glupteba-FTSD!F3D6BBD184BA
• Kaspersky (KVRT): HEUR:Trojan.Win32.Copak.vho

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• ctldl.windowsupdate.com
• rb.symcd.com
• rb.symcb.com
• login.live.com
• ocsp.digicert.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• oneocsp.microsoft.com
• www.msn.com
• settings-win.data.microsoft.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• inference.location.live.net
• licensing.mp.microsoft.com
• www.bing.com
• assets.msn.com
• tas02.sls.update.microsoft.com

Embedded domains

• g2.jp

Embedded IP addresses

• 104.208.16.94
• 57.155.101.212
• 4.230.171.124
• 4.144.132.114
• 52.123.252.225
• 104.46.162.230
• 74.178.76.128
• 20.165.94.54
• 172.178.240.163
• 40.104.4.2
• 20.42.73.31
• 52.148.114.188
• 20.112.250.133
• 52.123.128.14
• 52.110.12.42
• 52.110.12.5
• 172.66.2.5

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report