MALICIOUS — 9ebd9d0c7ea3da6655beb636cc82f8bee5d5d1acd01ef2c7333566caab63d510

MALICIOUS — 9ebd9d0c7ea3da6655beb636cc82f8bee5d5d1acd01ef2c7333566caab63d510 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Psixbot family. 6 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 9ebd9d0c7ea3da6655beb636cc82f8bee5d5d1acd01ef2c7333566caab63d510
SHA-1: 27595322fb61c669d879b2509aa7f4ddf68ceb98
MD5: 05d2b5dc6002537160f81fdabba79739
imphash: 8fecd48a2a2309d9acd4f1e6ab7123d1
ssdeep: 3072:tZTz1WIXC6GESSgWNRXumi7+IF6foPCaTRMXbaev0FQcmWk6kwsNIf6cHzbQ2v0:tZHcIX9SSgMi+IFZMbQrkodzb4VF2Yd
TLSH: T18C467CCE4119779FDA379E113850AAAEA4A2F8C6D4B53F0C0A87C43A3191C1BED7145B
Submitted as: 9ebd9d0c7ea3da6655beb636cc82f8bee5d5d1acd01ef2c7333566caab63d510
File type: pe · Size: 302623 bytes
Verdict: malicious (100/100) · Family: Psixbot

Detections (6 of 56 engines)

capa (capabilities): capability:execution/powershell
ClamAV (daily): Win.Malware.Psixbot-9917128-0
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/PsiXBot!pz
Emsisoft (Emergency Kit): Adware.GenericKD.61115760
Kaspersky (KVRT): HEUR:Backdoor.Win32.PsixBot.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Malware.Psixbot-9917128-0 (rule Win.Malware.Psixbot-9917128-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/PsiXBot!pz (rule Trojan:Win32/PsiXBot!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Adware.GenericKD.61115760 (rule Adware.GenericKD.61115760) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Backdoor.Win32.PsixBot.gen (rule HEUR:Backdoor.Win32.PsixBot.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497.001, T1497 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://checkip.dyndns.org/, http://rrradiusspace.bit/, http://spinner.bit/ - static signal, weight 0.35, confidence 0.60
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

26605 behavior events · 2 ATT&CK techniques · 14 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - f9ddc674391dde0eb31ec43a0204db4034a5a4aa888caf63b1ec7d77eb0f1049
C:\Users\analyst\AppData\Local\Microsoft\audiohd.exe - fe2f8a60b9f7ca63a30edb51673d6843601bf046ddf82285957b32eb98392f5c
C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_0j2n5k0k.xxh.psm1 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
C:\Users\analyst\AppData\Local\Microsoft\local.cs - 6da3e26b268e4a6c21e192c8b9a1b89aef6880bad673b79e6a889d29641ac2cc
4e717e3508a649d7734e8e0abd44599382e39e9f09305b01211f30dd37639d53 - 4e717e3508a649d7734e8e0abd44599382e39e9f09305b01211f30dd37639d53
ce225d64589e14f8ca17792329a6c75f6c1f0b006ae3a0a193ee780e49530be3 - ce225d64589e14f8ca17792329a6c75f6c1f0b006ae3a0a193ee780e49530be3
0b830d7f43fbe2fad1d3e520199cce1f0bb3644dd5ccc403f065635df4e14154 - 0b830d7f43fbe2fad1d3e520199cce1f0bb3644dd5ccc403f065635df4e14154
37d14b1bf6f351010ee08e03381a69fb9ce3637123d8f924b6aaa4e0ea712c0e - 37d14b1bf6f351010ee08e03381a69fb9ce3637123d8f924b6aaa4e0ea712c0e
49eeaa8f40b351519b92bdeafbbee123d297dfd13b57d5be04b24624135ada4a - 49eeaa8f40b351519b92bdeafbbee123d297dfd13b57d5be04b24624135ada4a
8d4c4987a2320604a01b78b9865eedb7f469786e1200f8fbe7cdf8bea34a14d0 - 8d4c4987a2320604a01b78b9865eedb7f469786e1200f8fbe7cdf8bea34a14d0
4220e1748b4593b29782769a60fa733b5010391f3a8ad59bfcffa39d536e44a4 - 4220e1748b4593b29782769a60fa733b5010391f3a8ad59bfcffa39d536e44a4
7ff22075c65ae2ca2406b99554a48bc56ba27006db08a1d7e2ab8252f9251304 - 7ff22075c65ae2ca2406b99554a48bc56ba27006db08a1d7e2ab8252f9251304
0daeb2b72073fa8819a0abf032f903c64409412473906de960ac77f6aeccb715 - 0daeb2b72073fa8819a0abf032f903c64409412473906de960ac77f6aeccb715
6dcb681bafad138de41a33ba9e630a816dbcdf6e9ba60d58ade5923b194ffbc6 - 6dcb681bafad138de41a33ba9e630a816dbcdf6e9ba60d58ade5923b194ffbc6

Embedded URLs

http://checkip.dyndns.org/
http://rrradiusspace.bit/
http://spinner.bit/
http://getreserv.su/safedomain.txt
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

checkip.dyndns.org
dns2.soprodns.ru
dns1.soprodns.ru
getreserv.su
rrradiusspace.bit
spinner.bit
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

5.154.191.67
185.121.177.177
169.239.202.202
198.251.90.143
111.67.20.8
163.53.248.170
139.59.17.152
142.4.204.111
142.4.205.47
158.69.239.167
192.99.85.244
31.3.135.232
31.171.251.118
81.2.241.148
62.113.203.99
37.58.63.27
130.255.78.223
144.76.133.38
82.141.39.32
139.59.208.246
172.104.136.243
130.255.73.90
195.154.226.249
212.47.242.157
87.98.175.85

File paths

G:\WORK\MONEY\BOT\NoName\PsiX\obj\x86\Release\source2.pdb
c:\users\user\source\repos\WindowsProject1\Release\WindowsProject1.pdb
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Program
C:\Windows\SysWOW64\WindowsPowerShell
C:\Windows\explorer.exe

More Psixbot samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report