MALICIOUS — a351ce5f3ae9db2ba82db799a9f9ddb03c58eeabc0b7ab6fae1f2dacd45dff34

MALICIOUS — a351ce5f3ae9db2ba82db799a9f9ddb03c58eeabc0b7ab6fae1f2dacd45dff34 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Wapomi family. 7 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: a351ce5f3ae9db2ba82db799a9f9ddb03c58eeabc0b7ab6fae1f2dacd45dff34
SHA-1: 777e4025140320dafbe3875215e63c741a750af8
MD5: 63b08ee1c852a17ffabe7cf6b0cfdc2f
imphash: 5e24f42b46c247f13d78f0f21a4a2bf7
ssdeep: 1536:aogtezQFW6GRGiJoOuqSyEQax/wGJKq1Kd0hT7LbMLitTIzU92FfHYTo7gGGCq2:aobLh1JFWQaP1pT7kc39wfHYTo7HGCH
TLSH: T1013C9E98030AA785D7F7CB5179946F0F9093B4EDA0FE3D8C2A83C11F62F14A7946119A
Submitted as: a351ce5f3ae9db2ba82db799a9f9ddb03c58eeabc0b7ab6fae1f2dacd45dff34
File type: pe · Size: 114688 bytes
Verdict: malicious (100/100) · Family: Wapomi

Detections (7 of 52 engines)

ClamAV (daily): Win.Malware.Wapomi-10020301-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Kaspersky (KVRT): Virus.Win32.Nimnul.f
Microsoft Defender: Virus:Win32/Mikcer.B
Emsisoft (Emergency Kit): Win32.VJadtre.3
Trellix Stinger (McAfee): Trojan-FVWC!63B08EE1C852

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Wapomi-10020301-0 (rule Win.Malware.Wapomi-10020301-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Madeba): 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07 - dynamic signal, weight 0.80, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 36 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 1.1.0.14 - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

13006 behavior events · 2 ATT&CK techniques · 50 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/10627/files/4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07 - 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
/opt/CAPEv2/storage/analyses/10627/files/0e03675850241d06080af9ec470649ca4a006222c4ff5d1b05029f1751fecf91 - 0e03675850241d06080af9ec470649ca4a006222c4ff5d1b05029f1751fecf91
/opt/CAPEv2/storage/analyses/10627/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/10627/files/920fb0937f8a9d345830865059b6ae3f35ab6803ad4cffef4447473ec18e17a0 - 920fb0937f8a9d345830865059b6ae3f35ab6803ad4cffef4447473ec18e17a0
/opt/CAPEv2/storage/analyses/10627/files/f19afa9bbf2ef0308f37ce6cb87cb3c59eb2d1685e08d8b15fd197dda813f379 - f19afa9bbf2ef0308f37ce6cb87cb3c59eb2d1685e08d8b15fd197dda813f379
/opt/CAPEv2/storage/analyses/10627/files/079771f6478bb63f24119685df1262ea2735295a3022ba6c1d509650800797e4 - 079771f6478bb63f24119685df1262ea2735295a3022ba6c1d509650800797e4
/opt/CAPEv2/storage/analyses/10627/files/ad9d855419484bac2e057cf09b3fbe14c7960f72e16049001551ae5783545f97 - ad9d855419484bac2e057cf09b3fbe14c7960f72e16049001551ae5783545f97
/opt/CAPEv2/storage/analyses/10627/files/bbb3de5707629e6a60a0c238cd477b28f07f0066982fda953fa6fcec39073a4a - bbb3de5707629e6a60a0c238cd477b28f07f0066982fda953fa6fcec39073a4a
/opt/CAPEv2/storage/analyses/10627/files/81bac677e834253ae60125ed1be64b1ed0cf25adacaee3fd70a4000b8d5bd508 - 81bac677e834253ae60125ed1be64b1ed0cf25adacaee3fd70a4000b8d5bd508
/opt/CAPEv2/storage/analyses/10627/files/249b0d96ae8bc49c773c0054b8a6d05f689cbcd9abc9572d30bfb2a2bac36b1a - 249b0d96ae8bc49c773c0054b8a6d05f689cbcd9abc9572d30bfb2a2bac36b1a
/opt/CAPEv2/storage/analyses/10627/files/e91dc258304b42180887679f892e47587a8d67d1140ffb3e8acf79deb95cdb9c - e91dc258304b42180887679f892e47587a8d67d1140ffb3e8acf79deb95cdb9c
/opt/CAPEv2/storage/analyses/10627/files/7e42b39d55f1ad07551daedacb1d0191c4b9cefeadf0008766819626bac923c1 - 7e42b39d55f1ad07551daedacb1d0191c4b9cefeadf0008766819626bac923c1
/opt/CAPEv2/storage/analyses/10627/files/81a618f21cb87db9076134e70388b6e9cb7c2106739011b6a51772d22cae06b7 - 81a618f21cb87db9076134e70388b6e9cb7c2106739011b6a51772d22cae06b7
/opt/CAPEv2/storage/analyses/10627/files/62aab98528514ce16def0b896fe9b756bd8f2589e641f2da204380fc08e75297 - 62aab98528514ce16def0b896fe9b756bd8f2589e641f2da204380fc08e75297
/opt/CAPEv2/storage/analyses/10627/files/cff0655995dea686f6f062cbf62fc83211f3e0c53e5e91a898e98f5d84863f32 - cff0655995dea686f6f062cbf62fc83211f3e0c53e5e91a898e98f5d84863f32

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786458303&P2=404&P3=2&P4=DpSpNJjo1AJtohn%2f%2b9ZBAmli3y0%2bWYMWwK65hAYvHYqcCbo%2bbGJw87GxYf4hCTOvdcvsZ878ZOcCZVV7bLdVPA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786458371&P2=404&P3=2&P4=b6Vi48jY7CZckOXYKQhJZLxG%2f%2bNokl3AUxxaj%2bAJGxDZKlXZz0NK%2bveWc8W2%2fs%2bOkUgjjv9kMk%2bUA1Bp0JpCQw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ddos.dnsnb8.net

Embedded IP addresses

1.1.0.14
13.89.179.12
57.155.104.224
52.123.252.222
74.178.76.44
20.247.184.142
4.230.171.124
20.42.179.204
20.165.94.63
74.178.76.54
4.150.223.114
135.233.45.223
3.229.117.57
52.110.12.48
52.110.12.38
203.26.79.13
52.123.252.227
135.233.95.80
52.148.114.188
72.145.35.99
52.110.12.51
52.110.12.45

File paths

C:\Users\Vinay\Projects\simple_launcher\dist\t32.pdb
X:\:`:d:h:l:p:t:x:

More Wapomi samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report