MALICIOUS — 9a31aefa08b19489a6b5f35cc08d1e6d81c7ade73dfeb56eb4f4261d31242537

MALICIOUS — 9a31aefa08b19489a6b5f35cc08d1e6d81c7ade73dfeb56eb4f4261d31242537 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Fileinfector family. 6 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 9a31aefa08b19489a6b5f35cc08d1e6d81c7ade73dfeb56eb4f4261d31242537
SHA-1: 3e740b18201e6e5fa3e3b630f09091539963bb7e
MD5: a949b1db6a4abdedb8f3e9405de78195
imphash: 8db24069821f53bc0c77c75b1ea46dcd
ssdeep: 393216:RkgaSUd8qqObMkgaSUd8qqObukgaSUd8qqObckgaSUd8qqOb:RkgaSUaqlMkgaSUaqlukgaSUaqlckga
TLSH: T16C6E8DD21347B646E2B7CAB4B4811A5E5AF3B0BA30BF645C4592D02F23F5CA750F9218
Submitted as: 9a31aefa08b19489a6b5f35cc08d1e6d81c7ade73dfeb56eb4f4261d31242537
File type: pe · Size: 14213208 bytes
Verdict: malicious (97/100) · Family: Fileinfector

Detections (6 of 55 engines)

ClamAV (daily): Win.Malware.Fileinfector-9832954-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Trellix/McAfee ATR: ATR_Conti_Ransomware
LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: Trojan:Win32/Vindor!pz
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

T1547.001

Why this verdict

The malicious score of 97/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Fileinfector-9832954-0 (rule Win.Malware.Fileinfector-9832954-0) - engine signal, weight 0.90, confidence 0.95
Contacted 20 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Trellix/McAfee ATR flagged ATR_Conti_Ransomware (rule ATR_Conti_Ransomware) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.pinkworld.com, http://www.youporn.com, http://www.redtube.com - static signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

106 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://crl.verisign.com/tss-ca.crl0
http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0O
http://www.microsoft.com/directx0
http://www.pinkworld.com
http://www.youporn.com
http://www.redtube.com
http://www.assparade.com/
http://www.freeav.com/
http://www.antispyware.com/
http://www.antivirus.com/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787916094&P2=404&P3=2&P4=PwLAlDmHhTl091MxnbVl1xLG%2bHCHUJd2RdxUU0XWElxHl%2fFiHxwarmDbqj0LTSXwtXJI86MwHQqWkggmjRVMXA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.verisign.com
crl.microsoft.com
www.microsoft.com
www.pinkworld.com
www.youporn.com
www.redtube.com
www.assparade.com
www.freeav.com
www.antispyware.com
www.antivirus.com

Embedded IP addresses

4.207.44.73
52.123.252.242
172.215.188.225
4.230.171.124
52.230.59.222
52.123.252.247
74.179.71.159
74.178.76.128
51.104.15.253
203.26.79.13
20.76.201.171
52.123.129.14
52.123.128.14
74.179.77.164
104.46.162.230
135.233.45.223
52.110.12.28
52.110.12.25
52.148.114.188
72.145.35.107

File paths

X:\:`:d:h:l:H
T:\:
K:\:k:v:
P:\:v:
V:\:h:t:z:
B:\:b:j:x:
S:\:f:l:r:z:
C:\Program

More Fileinfector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report