MALICIOUS — a120bb56775bd34337709b59a91c7a28c4b7dd9a158fb4162a8a0366a6b8cc98

MALICIOUS — a120bb56775bd34337709b59a91c7a28c4b7dd9a158fb4162a8a0366a6b8cc98 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Fileinfector family. 4 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: a120bb56775bd34337709b59a91c7a28c4b7dd9a158fb4162a8a0366a6b8cc98
SHA-1: 30cffb846c10c892f5ba9f6e749fa6f44af52a9a
MD5: 217b81702370ee0ebb3f54a6ab66b9ce
imphash: a9192bab5c7c795c7488b69a1853f9c2
ssdeep: 6144:MZjroZjroZjroZjroZjroZjroZjroZjroZjroZjroZjroZjrP:MZroZroZroZroZroZroZroZroZroZroI
TLSH: T1A447948572042721ECF4B855AD05AD2C3282ADA562363BDC7603D43F34E9BF7057A86E
Submitted as: a120bb56775bd34337709b59a91c7a28c4b7dd9a158fb4162a8a0366a6b8cc98
File type: pe · Size: 339495 bytes
Verdict: malicious (99/100) · Family: Fileinfector

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Fileinfector-9831958-0
Microsoft Defender: Trojan:Win32/CryptInject!pz
Trellix Stinger (McAfee): Trojan-FUFL!217B81702370
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Fileinfector-9831958-0 (rule Win.Malware.Fileinfector-9831958-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Terminates Browser, Office or Security Processes [medium] (rule tl-process-kill) - dynamic signal, weight 0.40, confidence 0.90
Contacted 66 external host(s) at runtime (30 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.pinkworld.com, http://www.youporn.com, http://www.redtube.com - static signal, weight 0.35, confidence 0.60
Dropped 15 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

75950 behavior events · 2 ATT&CK techniques · 27 dropped files.

Dropped files

C:\Windows\System32\vccorlib140.dll - 70cfaf45a2e85ff332818ee087ddba1b621f5bd82fe102d167059e012fd8abe9
C:\Windows\Professional.xml - 3cca1ecc7083dcb7429da397cab5f86ce3fc0566143b8def44c67f338dd3d5c4
C:\Windows\System32\PrintConfig.dll - 08b916246d42f6226b960ed53cddd8f3048528f7c7eaf3d7f31e0fb4740d6045
C:\Windows\System32\msvcp140_1.dll - 5e4da27e5072e8992c8bd5a42d59726f5366498af35454b5f31c9d7bc7a973db
C:\Windows\WindowsUpdate.log - 401dd740591d43ddb5896fb719583bd60ad7efbaa0ddc8f4794f1eb2064e48e3
C:\Windows\System32\msvcp140_2.dll - 8c8bfbb4c3292402af56aa2355e04da18179012d05e1bb89913e6a52456d9e8e
C:\Windows\System32\opencl.dll - e9a8193e7f9e8441207c69bb7ae943a318b50987fddcf8cc54bf25267c698a7f
C:\Windows\setupact.log - 0a4bb908ac9438044514fea2d6b242edb8ebba6be26ca0048e1246aea13b1f22
C:\Windows\System32\dssec.dat - cbc8ce682a918716b7a0dd382a763446c6f856749ac62f465b94f45327ffc88e
C:\exc.exe - 96cb62ac27535ea067b5fa1a2727156549d97bff365c98f177f5ad4bf1bf0402
C:\Windows\setuperr.log - 340d52f5f778fe15958a6f38b1a5b928b2f1bb0030b35356a69cc1df46945675
C:\Windows\System32\msvcp140_codecvt_ids.dll - 91dc6c1c0af69a77ea7c797463f8c5d457580b5eee4322aaca4468146d0115e1
C:\Windows\System32\vcruntime140_threads.dll - 3679a9ed2f732cd49f856ce439e88e7354215a5c74f4043757d5a385f22e7cdb
C:\Windows\System32\license.rtf - 8621fe59edfd4ccadd3c00a607d5a4674e046b7c00f887176ea853295fd66974
C:\Windows\System32\vcruntime140.dll - 1171573d589f0db5893be5b303e3809c7af783c5912ecfcf217f79102a11a403

Embedded URLs

http://www.pinkworld.com
http://www.youporn.com
http://www.redtube.com
http://www.assparade.com/
http://www.freeav.com/
http://www.antispyware.com/
http://www.antivirus.com/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787868666&P2=404&P3=2&P4=lJDc6fY0wwJzg1Y4vx%2fvd%2b61pJcbETGenGJvA5Cb3qck5y5KO6YkbmyOU0PcY%2fgDVtK6fofTKyO5jOZwaW6pEA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787868744&P2=404&P3=2&P4=KNaLy7Snue8%2bnK3AfTrhRjRNoMVyDflM5x28EBDgf5tXEHZMW3UOlI1iwyHck6URGS%2fhlSfLC8GDCJBbdu55CQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.pinkworld.com
www.youporn.com
www.redtube.com
www.assparade.com
www.freeav.com
www.antispyware.com
www.antivirus.com
www.avira.com
nexus.ensighten.com
assets.adobedtm.com
script.crazyegg.com
t.nc0.co
doh.cq0.co
www.webassetscdn.com
dpm.demdex.net
symantec.demdex.net
symantec.tt.omtrdc.net
s.go-mpulse.net
widget.trustpilot.com
data.privacy.ensighten.com
mhubc.avira.com
rmbyy5ra.avira.com
www.nortonlifelock.com
oms.avira.com
getrockerbox.com

Embedded IP addresses

20.42.73.31
20.247.184.197
4.230.171.124
4.247.188.224
74.178.240.61
4.207.44.77
74.178.240.51
20.236.44.162
52.123.129.14
52.123.128.14
52.123.252.239
135.234.160.244
40.84.97.4
51.105.71.136
40.79.141.153
203.26.79.13
135.232.92.34
52.148.114.188
52.110.12.4
52.110.12.11
172.178.240.163
52.58.28.12
20.11.121.11
13.70.178.62
52.123.252.195

More Fileinfector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report