MALICIOUS — 9b0f5e720e7feeb918e7ceeef7890297593ff14b6fdb50e79b8cb6a747386ff5

MALICIOUS — 9b0f5e720e7feeb918e7ceeef7890297593ff14b6fdb50e79b8cb6a747386ff5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sapbexts family. 7 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 9b0f5e720e7feeb918e7ceeef7890297593ff14b6fdb50e79b8cb6a747386ff5
SHA-1: 49a9d87590b5d4593cdec24dc754ef2a3eda8793
MD5: 567baadf1a1291add6a9d500b8db5468
imphash: 94fcd9d48b6126b342207181f74dd55d
ssdeep: 6144:zo5I1lwfDr4WKAn7gTiXgp/yVJ+cqfPBOOq:zo5IAP4WxnEggpy6QO
TLSH: T19B458DDC8121A346F672DED06D006D2C50A1F4DA917E2C9B07CFC01F6AE396F626919E
Submitted as: 9b0f5e720e7feeb918e7ceeef7890297593ff14b6fdb50e79b8cb6a747386ff5
File type: pe · Size: 278528 bytes
Verdict: malicious (100/100) · Family: Sapbexts

Detections (7 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: PWS:Win32/Sapbexts.A
Emsisoft (Emergency Kit): Gen:Variant.Zusy.406898
Kaspersky (KVRT): UDS:Trojan.Win32.Xxmm.gen

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.70, confidence 0.70
Microsoft Defender flagged PWS:Win32/Sapbexts.A (rule PWS:Win32/Sapbexts.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Zusy.406898 (rule Gen:Variant.Zusy.406898) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan.Win32.Xxmm.gen (rule UDS:Trojan.Win32.Xxmm.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 2 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
query domain / anti-analysis (rule query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://82.146.51.22/dir.php, http://www.slutsstuff.com, http://82.146.51.22/xbrk.php - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

21 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://82.146.51.22/dir.php
http://www.slutsstuff.com
http://82.146.51.22/xbrk.php
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

dom2.net
subdom.dom.com
www.slutsstuff.com

Embedded IP addresses

82.146.51.22
20.42.73.28
52.123.252.218
4.230.171.124
40.84.97.4
172.215.188.225
135.233.95.144
20.184.175.20
74.178.240.51
20.247.184.197
74.178.76.128
104.18.33.89
52.168.112.66
52.110.12.14
172.178.240.162
52.110.12.18
125.56.205.26
125.56.205.32
52.110.12.31
52.110.12.52

Registry keys

HKEY_CURRENT_USER\Software\Microsoft\Internet
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet

File paths

C:\Users\Katy\Desktop\project\hyphernate_proc_exe\Typical
X:\:`:d:h:D;`;
T:\:d:l:t:

More Sapbexts samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report