MALICIOUS — 97491d265c275adef40ea3e6bf221f3f49e6c861a5819124b4c1f74107c2c0a2

MALICIOUS — 97491d265c275adef40ea3e6bf221f3f49e6c861a5819124b4c1f74107c2c0a2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fileinfector family. 4 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 97491d265c275adef40ea3e6bf221f3f49e6c861a5819124b4c1f74107c2c0a2
SHA-1: 6ebd467f4141a8d2b92905e78ecb233075d71753
MD5: f50da59280a032678455655d49afd154
imphash: a9192bab5c7c795c7488b69a1853f9c2
ssdeep: 6144:MZ7Z05B1gKZ7Z7Z05B1gKZ7Z05aZ7Z7Z05B1gJ:M5u1gK55u1gK5B55u1gJ
TLSH: T19E47B58532403710ECF5F9649948EC2C72939DA662762BDCB006D82F74F96F306B946E
Submitted as: 97491d265c275adef40ea3e6bf221f3f49e6c861a5819124b4c1f74107c2c0a2
File type: pe · Size: 336514 bytes
Verdict: malicious (100/100) · Family: Fileinfector

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Fileinfector-9834127-0
Microsoft Defender: Trojan:Win32/CryptInject!pz
Trellix Stinger (McAfee): Trojan-FUFL!F50DA59280A0
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Fileinfector-9834127-0 (rule Win.Malware.Fileinfector-9834127-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/CryptInject!pz (rule Trojan:Win32/CryptInject!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FUFL!F50DA59280A0 (rule Trojan-FUFL!F50DA59280A0) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.ks (rule Virus.Win32.Lamer.ks) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.pinkworld.com, http://www.youporn.com, http://www.redtube.com - static signal, weight 0.35, confidence 0.60
Dropped 23 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

114533 behavior events · 2 ATT&CK techniques · 37 dropped files.

Dropped files

C:\Windows\system.ini - 77fea1ea7cd768525267e8624b5c2b9daa634457441967723a084d4a9b448803
C:\Windows\pyshellext.amd64.dll - fe7d250c2c3e95a6f7c02b0bca253d193dc2f82ad02a39e3880b96dbaf08b1ff
C:\Windows\System32\vcomp140.dll - 84b57c724b04db8c7b1591c9f103c8346a6d8cae7c4c5c7577b894674a5af13d
C:\Windows\System32\msvcp140_atomic_wait.dll - 92f40709e94472b1e03c1cbb40a982d87287f3692258553ee9182080bbb299a0
C:\Windows\SysmonDrv.sys - e38a297a929b691c81eaf4892a0e14f236100a6861f7bb400a6e80c52dc97350
C:\Windows\System32\mfc140u.dll - c1e54770081f60e029e9ff001b5bb4ee7ceaa3fc208eb3ef2bffbf8c1d69df68
C:\Windows\System32\NOISE.DAT - 46f2f6c47f30ea9673f76a57fd2664cee4f230ed05ee75f8f43fe74e4b218444
C:\Windows\pyw.exe - c96df1d7701fcbb1b7d275d5d6a4c6c016166b05af9fad456e73bbf5dc475922
C:\Windows\System32\msclmd.dll - 6ebe68aae4007aa00fcb5fc77d8e0d191aebcae3d72a60109701d4684e3f8783
C:\Windows\System32\PrintConfig.dll - b0faf44f0254a4b1d5077193963f4c17454ef6ecb32c9b15362235c35d691344
C:\Windows\System32\vulkan-1.dll - 7fc3cd129a0fba0b7f6062017010caeccfe347a9d9b128be5390c0066b1b4906
C:\Windows\System32\mmc.exe.config - c4e39a54d5986740a07b551f6b625dbcd72f7547416caad0d0d8dd0916ab1049
C:\Windows\System32\msvcp140_2.dll - f287584beb44fa8c625eed853e64c0d3c1aa5e938ea7048dd531973ad1853955
C:\Windows\win.ini - e1caf004d53a07dc367182a3ac928b26a6fddfac082f03eae0c68ef9b4bcb75e
C:\Windows\System32\vcruntime140_threads.dll - bf7a022ee8495a5e77c413707524fb5c56ad14887ced3482696e7eb66504d248

Embedded URLs

http://www.pinkworld.com
http://www.youporn.com
http://www.redtube.com
http://www.assparade.com/
http://www.freeav.com/
http://www.antispyware.com/
http://www.antivirus.com/
http://www.microsoft.com/pki/certs/CSPCA.crt0
http://www.microsoft.com/pki/certs/tspca.crt0
http://www.microsoft.com/directx/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://203.26.79.13/filestreamingservice//files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf?P1=1787354299&P2=404&P3=2&P4=ElLaAGSqvHE%2fud1oOy9cHTUmePvNSsovOeUG0kb6%2bBU6%2b%2bMYS0cpPMllI2X7kLzG0p4YKwEcdFNAK2Q5UFj2GA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.pinkworld.com
www.youporn.com
www.redtube.com
www.assparade.com
www.freeav.com
www.antispyware.com
www.antivirus.com
crl.microsoft.com
www.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.13
52.123.252.235
4.230.171.124
4.149.227.78
85.210.193.152
74.178.240.51
20.184.175.2
74.178.240.61
104.208.16.94
104.18.33.89
135.232.92.137
92.223.78.30
172.215.188.225
135.233.45.221
135.233.45.223
51.104.15.252
172.175.111.170
4.150.223.101
203.26.79.13
4.150.223.114
20.42.65.91
52.148.114.188
72.153.5.97
52.110.12.4
52.110.12.30

More Fileinfector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report