MALICIOUS — 9b2da7a06c299b17644dd6c39d2f4149c717708a4aaa217378a30329341a2b9c

MALICIOUS — 9b2da7a06c299b17644dd6c39d2f4149c717708a4aaa217378a30329341a2b9c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Delf family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 9b2da7a06c299b17644dd6c39d2f4149c717708a4aaa217378a30329341a2b9c
SHA-1: f870317b9693d5816f511df42aeef6a858395f24
MD5: ccb3f4708eb53fb652d773312f72f4d6
imphash: 842ba1c2436dd1a931cfdde74fd7ef17
ssdeep: 768:NiOQauOECLIK8u4qc+5aIjK4LrP+K5fE67y7N8FdUV0MeEM++o:Nip8JB5aOLL+K5E6U878xX
TLSH: T1DB337E761F2F2F1BEA7AD25788006A5D1862B8B934D54488C71FA8BDB3EEC03685111D
Submitted as: 9b2da7a06c299b17644dd6c39d2f4149c717708a4aaa217378a30329341a2b9c
File type: pe · Size: 48197 bytes
Verdict: malicious (100/100) · Family: Delf

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:DATA
ClamAV (daily): Win.Trojan.Gobot-20
YARA: Stratosphere IPS: STRATO_IRC_Botnet
Microsoft Defender: Backdoor:Win32/Delf.BA!MTB
Emsisoft (Emergency Kit): Gen:Trojan.IRC-Backdoor.cGX@aSF4T5g
Kaspersky (KVRT): Backdoor.Win32.Delf.ma

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Trojan.Gobot-20 (rule Win.Trojan.Gobot-20) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Backdoor:Win32/Delf.BA!MTB (rule Backdoor:Win32/Delf.BA!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Trojan.IRC-Backdoor.cGX@aSF4T5g (rule Gen:Trojan.IRC-Backdoor.cGX@aSF4T5g) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Delf.ma (rule Backdoor.Win32.Delf.ma) - engine signal, weight 0.55, confidence 0.85
YARA: Stratosphere IPS flagged STRATO_IRC_Botnet (rule STRATO_IRC_Botnet) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 149 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:DATA (rule high-entropy-sections:DATA) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-sections:DATA - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

513 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Windows\vLGx4Vu4Y.exe - 236ab8e988fdc9db097d8f7ba447e7a49e95ee38f194dc8c29ca36cedc28987b

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

52.182.143.212
52.253.84.76
4.230.171.124
129.27.9.247
146.193.230.234
40.25.102.166
192.169.139.61
140.239.3.142
160.100.160.219
38.146.170.50
18.100.188.5
220.50.76.219
144.69.183.248
143.4.32.209
121.77.155.48
68.79.214.34
197.108.56.27
175.18.175.220
197.203.34.166
104.212.180.117
42.9.202.225
112.75.30.160
218.74.16.186
33.216.64.37
197.7.255.152

More Delf samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report