MALICIOUS — a8681f14c4326b2cdd2bef546676771bfd6a9e4460380e2b7f38447d11f6e448

MALICIOUS — a8681f14c4326b2cdd2bef546676771bfd6a9e4460380e2b7f38447d11f6e448 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Doina family. 8 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: a8681f14c4326b2cdd2bef546676771bfd6a9e4460380e2b7f38447d11f6e448
SHA-1: 749e08fc941e519c5ce292e1fcd1182fdbd089f9
MD5: 034bd0853b43d1b15ff4a74dcd4c1b1f
imphash: 99c27169ecdf0bb12dce110e9380f78a
ssdeep: 98304:+t+ww48YTRGrjsYrXa1PSELk/GEAUfZ82ub8GRprbGJ1y1xWcdGWLpDi5PdjDJi:+xaELkaUfdOMeXdVlG5Fp+
TLSH: T1976612CC1E10A714EAF287557C508D5F4AA3F09DB9BED43C0D8BD49EB261473A422AC9
Submitted as: a8681f14c4326b2cdd2bef546676771bfd6a9e4460380e2b7f38447d11f6e448
File type: pe · Size: 6679203 bytes
Verdict: malicious (99/100) · Family: Doina

Detections (8 of 56 engines)

YARA: MalwareAnalyser built-in: Packer_UPX_Sections
MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.data0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: MalwareAnalyser community pack: TL_UPX_Packed
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/Downloader.CF!MTB
Emsisoft (Emergency Kit): Gen:Variant.Doina.23645
Kaspersky (KVRT): VHO:Trojan.Win32.Exnet.gen

MITRE ATT&CK

YARA

Packer_UPX_Sections

Why this verdict

The malicious score of 99/100 is the fusion of 15 weighted signals:

Microsoft Defender flagged Trojan:Win32/Downloader.CF!MTB (rule Trojan:Win32/Downloader.CF!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Doina.23645 (rule Gen:Variant.Doina.23645) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged VHO:Trojan.Win32.Exnet.gen (rule VHO:Trojan.Win32.Exnet.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
UPX packer section names (rule Packer_UPX_Sections) - yara signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 21 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser built-in flagged Packer_UPX_Sections (rule Packer_UPX_Sections) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.data0 (rule high-entropy-sections:.data0) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_UPX_Packed (rule TL_UPX_Packed) - engine signal, weight 0.30, confidence 0.70
Embedded network infrastructure: https://secure.comodo.net/CPS0A - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.data0 - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

220 behavior events · 0 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\cfg.ini - f39d927b1c32f38d11009ea31afbc65009617c8dae09beda90fd7d8488ba54e0
C:\Users\analyst\AppData\Local\Temp\msedge_installer.log - 1b51041f8085d0ebd1398f4512718ea8209893ca9f1c64bdf530e0cacf0f6eee
C:\Users\analyst\AppData\Local\Temp\tsk_59XI36Fon7KUH2m.exe - 8d9a24e8eed7a030a94ee5e8c29d4ce184cbb309156db4d83f921a51eb41b6d6
C:\Users\analyst\AppData\Local\Temp\cv_debug.log - 624ff0124ff1097c61c11a6f0265e516a900cc1aafb44110142df0f8f1aaf69a
C:\Users\analyst\AppData\Local\Temp\wmsetup.log - b11630055c84537e8859368be34c50cda8d82b8db9a15082ef95f4fd68c7b155

Embedded URLs

http://crl.thawte.com/ThawteTimestampingCA.crl0
http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
https://secure.comodo.net/CPS0A
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

www.qq.com
3x.ca
k.tw
crl.thawte.com
crl.usertrust.com
ts-aia.ws.symantec.com
ts-crl.ws.symantec.com
crt.usertrust.com
secure.comodo.net
crl.comodoca.com
crt.comodoca.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.98
52.123.252.234
135.232.92.97
40.79.163.154
4.230.171.124
20.42.179.192
135.233.95.144
52.230.59.222
52.123.252.226
52.123.252.204
172.175.111.170
52.178.17.232
40.79.141.153
34.104.35.123
203.26.79.13
104.18.33.89
52.148.114.188
20.42.73.24
20.42.65.88
52.110.12.4
52.110.12.55
72.154.7.107

File paths

X:\:h:l:p:t:x:
m:\tf\0I0.log
M:\src\04F\_SHW_CF_181213\SWH_DLL_01\HookDll\Release\HookDll.pdb
T:\:d:l:t:
U:\:s:}:
T:\:t:
e:\i+

More Doina samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report