MALICIOUS — 96239de26385d3a3a77028995bf6c640bb561e23595c5112fbb13564b389dbda

MALICIOUS — 96239de26385d3a3a77028995bf6c640bb561e23595c5112fbb13564b389dbda is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Vtflooder family. 5 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 96239de26385d3a3a77028995bf6c640bb561e23595c5112fbb13564b389dbda
SHA-1: d895ca3577f4d693cfdb66fc60bfdc2b409361a7
MD5: bebe9cfc5be35d7871ae6f9affae2b16
imphash: cf533625af448ad22653a182bf083f59
ssdeep: 384:bx02c+NiNMhaS9MySYitL93lppji83C8ARDr3QfTQkNEExIstAv3ATefCiigrcLS:62XiNCR9MLYWi8JsOOstAv3ATec460td
TLSH: T1172BF7DFA224A464D511AF2387D149FC103FB879D2A2534A3C83CE1A6FD0C7B95B950A
Submitted as: 96239de26385d3a3a77028995bf6c640bb561e23595c5112fbb13564b389dbda
File type: pe · Size: 22212 bytes
Verdict: malicious (100/100) · Family: Vtflooder

Detections (5 of 56 engines)

ClamAV (daily): Win.Malware.Vtflooder-6725383-1
Microsoft Defender: Trojan:Win32/Vflooder.C
Emsisoft (Emergency Kit): Trojan.Agent.BYFH
Trellix Stinger (McAfee): Agent-FEU!BEBE9CFC5BE3
Kaspersky (KVRT): Trojan-Spy.Win32.Agent.cpyi

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Vtflooder-6725383-1 (rule Win.Malware.Vtflooder-6725383-1) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Vflooder.C (rule Trojan:Win32/Vflooder.C) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.BYFH (rule Trojan.Agent.BYFH) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Agent-FEU!BEBE9CFC5BE3 (rule Agent-FEU!BEBE9CFC5BE3) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Spy.Win32.Agent.cpyi (rule Trojan-Spy.Win32.Agent.cpyi) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 25 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

99519 behavior events · 2 ATT&CK techniques · 8 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199 - a6f8f5d4ffd1e825ffce9a55861f16aa4dbe67871b1696b976194dd8be1fdf29
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75A092F4522006A97542D6AC4F4E69D2 - 898087debf1c653f0305cd660524a48a25550a51dc9d89ba710da2420f6d523a
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA - aacc0711f18fcd81883bc43294cd5e4be9016eef2058216a673e09108edcb114
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA - ec5aa64ad86e81313164f1c7097b0112fdf9d38822d7742c8ee0017c8f3265b4
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\71D3A36027B1506445FB345FD67207AC - 54351198229f1541ec5669e353e6860e5d78e9564bc505641e77a1b3ab77b4dc
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199 - 2a6423c76f3fcf7939d348425dbab070e74857ab5de8eb3a03e195fc363a411b
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\71D3A36027B1506445FB345FD67207AC - 07da92050b6f1aa0835aa2fa00a316194d50f1eacb7b1853c079551c313f043e
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75A092F4522006A97542D6AC4F4E69D2 - 0e79415723d090ce4ffa1f034615f58610cf41cafb03f8c5e3793455070bbfd8

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://google.com/
http://c.pki.goog/r/r1.crl
http://c.pki.goog/wr2/oBFYYahzgVI.crl
http://www.virustotal.com/vtapi/v2/file/scan
http://c.pki.goog/wr3/MbJBMFoQ-sk.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

a6281279.yolox.net
www.virustotal.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.89.1.9
52.123.252.215
4.247.188.224
4.230.171.124
20.247.184.142
135.232.92.137
20.165.94.54
20.89.1.8
135.233.95.144
104.18.33.89
51.116.253.170
4.150.223.108
20.42.73.25
34.54.88.138
92.223.78.30
172.215.188.225
125.56.205.32
125.56.205.24
52.110.12.52
52.110.12.24

More Vtflooder samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report