MALICIOUS — 9fdc45cf19c797cb7a4aca7b12f089c3ed5cacd5719de206e807797d5780de8e

MALICIOUS — 9fdc45cf19c797cb7a4aca7b12f089c3ed5cacd5719de206e807797d5780de8e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mikey family. 7 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 9fdc45cf19c797cb7a4aca7b12f089c3ed5cacd5719de206e807797d5780de8e
SHA-1: d3e97aa8f9b9524138189e9e4c3da44ddbcae171
MD5: 6cea7fb933bc53aa6a5d63e035068159
imphash: 09d0478591d4f788cb3e5ea416c25237
ssdeep: 6144:NKLOgsgomKLEFESGz0SPpeEPkPDPrzgtRY5RdrHc13FG9ItU6GvPwR:AOgwmisETzuaeDPvjJ81VGqK6GvP+
TLSH: T19B4BD099C2F2A7C9DAF39370AD20824D20D25CDAE07F8CD85F83D156A2D1C9BD1E115A
Submitted as: 9fdc45cf19c797cb7a4aca7b12f089c3ed5cacd5719de206e807797d5780de8e
File type: pe · Size: 477578 bytes
Verdict: malicious (99/100) · Family: Mikey

Detections (7 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
ClamAV (daily): Win.Packed.Mikey-9645700-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Urelas!pz
Emsisoft (Emergency Kit): Gen:Heur.Mint.SP.Urelas.1
Kaspersky (KVRT): UDS:Backdoor.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Packed.Mikey-9645700-0 (rule Win.Packed.Mikey-9645700-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 32 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 1.234.83.146, 133.242.129.155, 218.54.31.226 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

20452 behavior events · 2 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\duvua.exe - e1d45645f8661d67063f7965a13a9376f81816e21a74b0c1e753d033f8cbfbc3
C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - c0749aec40a4b65df4b2a95286680ff0f1e5d9b16eaf4eca4186f14809fe4e92
C:\Users\analyst\AppData\Local\Temp\jilei.exe - 1d5591ab0491700c76eeff7aa65ae055b3e45fb377eb9e82ca7a2badf18b7a22
C:\Users\analyst\AppData\Local\Temp\jilei.exe - c877f29af866edc3fdc7cdb623f552c744753302e04de5a4920d605746aac667
ce3823015561c26b2525bbae8c13686b07c525ed24fa18305ce0d6c46cc17fca - ce3823015561c26b2525bbae8c13686b07c525ed24fa18305ce0d6c46cc17fca

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787886070&P2=404&P3=2&P4=jUmeWb%2buMCjmviRz4j%2bmJMU2pyrR0FO9AIHaIbR3t4RR8STfhYg%2bQbIhzPQHtdm56bM5H6E1GMw%2b8iqzft30BA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787886168&P2=404&P3=2&P4=TXkqSLs30yjRV7ewV9bRf60pPWgtkVRn5Tc53VENuROzW4Rcs3ALJuCVnCEyvPTt%2bK84DdkRPOFHLoxCZHAmHg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

1.234.83.146
133.242.129.155
218.54.31.226
85.210.193.152
52.168.117.171
52.123.252.218
4.230.171.124
4.247.188.224
4.144.132.114
135.232.92.137
135.232.92.97
4.150.223.104
40.99.133.226
20.76.201.171
40.99.134.18
172.66.2.5
52.123.129.14
52.123.128.14
52.182.143.212
52.123.252.224
172.178.240.161
203.26.79.13
52.110.12.51
52.110.12.19
52.148.114.188

More Mikey samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report