MALICIOUS — 9b3c6fd39b2809e388255c5651953251920c5c7d5e77da1070ab3c127e8bdc11

MALICIOUS — 9b3c6fd39b2809e388255c5651953251920c5c7d5e77da1070ab3c127e8bdc11 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Doina family. 5 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 9b3c6fd39b2809e388255c5651953251920c5c7d5e77da1070ab3c127e8bdc11
SHA-1: 44d11fb393e578acb89d40685585762e759f6170
MD5: d9940a3da42eb2bb8e19a84235d86e91
imphash: d10efbca59826ff9249dcadaafdb666d
ssdeep: 12288:yWXZfKjx4IT0WkC1PnQDxvgwke+LEGvxz5tC3:TIwWP1/ixvgK8EW1tq
TLSH: T19A4902D947A9ED43D5E3F30627998D9C6BA3EC8E25596C0C01D0902D2BF056F88E9339
Submitted as: 9b3c6fd39b2809e388255c5651953251920c5c7d5e77da1070ab3c127e8bdc11
File type: pe · Size: 406745 bytes
Verdict: malicious (99/100) · Family: Doina

Detections (5 of 51 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
ClamAV (daily): Win.Trojan.Agent-30776
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Gen:Variant.Doina.26717

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-30776 (rule Win.Trojan.Agent-30776) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Doina.26717 (rule Gen:Variant.Doina.26717) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 30 external host(s) at runtime (7 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

23843 behavior events · 2 ATT&CK techniques · 5 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/5169/files/52c68c28724558266f4a691de33b5f7036aa99475958619ee19c2c8276c59149 - 52c68c28724558266f4a691de33b5f7036aa99475958619ee19c2c8276c59149
/opt/CAPEv2/storage/analyses/5169/files/1d540a2a293f0efff6c5efe8f42c63915b248b0344b0bc0b216d8c3be062b1c2 - 1d540a2a293f0efff6c5efe8f42c63915b248b0344b0bc0b216d8c3be062b1c2
fa4426b086381568d4c3c3823b23233c1a5a18b8e078c2f434a76c181bfd4b4d - fa4426b086381568d4c3c3823b23233c1a5a18b8e078c2f434a76c181bfd4b4d
c2da46fc1a9cba75ef77d3077097aadeaa41c98a0c94a54db15dec265337328f - c2da46fc1a9cba75ef77d3077097aadeaa41c98a0c94a54db15dec265337328f
27a62960d1b5a76444b7a94157009b5a89e94d215178c42db2b4ba37788a91a2 - 27a62960d1b5a76444b7a94157009b5a89e94d215178c42db2b4ba37788a91a2

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice/files/15f5d388-aefb-49dc-ba9c-bc58b098ac43?P1=1785380283&P2=404&P3=2&P4=D46CEEFtrsyl5RDbtzVgpPLHeJzhZq4jKfnJYrUEhx6Cq5fQH4ciWZ8vGpp9EUSexC8y6YRs8NXQK3b8KzWN0g%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

aefd.nelreports.net
oneclient.sfx.ms
roudan.serveftp.com
mac.gov.hpc.tw

Embedded IP addresses

23.33.238.100
23.46.10.19
23.33.238.103
20.89.1.9
52.230.59.222
23.40.52.209
135.233.45.221
61.67.151.188
172.178.240.161
4.150.223.102
20.42.73.31
23.33.238.102
40.84.97.4
72.147.149.16
40.79.163.155
20.190.167.20
150.171.109.17
23.40.52.211
52.123.252.204
20.184.175.5
203.26.79.13
23.40.52.111
52.148.114.188
150.171.27.11
23.221.133.185

More Doina samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report