MALICIOUS — a87a6f41b9e41fc4babc8f67d1432598f8c0de86ed791a895483befcdc409f1d

MALICIOUS — a87a6f41b9e41fc4babc8f67d1432598f8c0de86ed791a895483befcdc409f1d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Reconyc family. 5 of 52 detection engines flagged it.

Identification

• SHA-256: a87a6f41b9e41fc4babc8f67d1432598f8c0de86ed791a895483befcdc409f1d
• SHA-1: 94e06f2a1f382f4e122c901185d9391309b13575
• MD5: 2275814ad49bb459eebbb728a317a602
• imphash: b672bf4528e2ef8904397d0b17905606
• ssdeep: 49152:tU/5M1X4Wl/YvzYCQR9RQs+C40yZpJaD99GY:tKq4oEa9RQs+Cn4/UKY
• TLSH: T1E25DD0C343534157F42D92254F94D52E389FA8EAA518A378C23CCE9E27E3643A159C3B
• Submitted as: a87a6f41b9e41fc4babc8f67d1432598f8c0de86ed791a895483befcdc409f1d
• File type: pe · Size: 2711070 bytes
• Verdict: malicious (96/100) · Family: Reconyc

Detections (5 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
• ClamAV (daily): Win.Packed.Trojanx-9883093-0
• Detect It Easy (packer/type): DIE:Themida/Winlicense 3.XX
• Microsoft Defender: Trojan:Win32/Reconyc.DA!MTB
• Kaspersky (KVRT): HEUR:Trojan.Win32.Convagent.gen

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Win.Packed.Trojanx-9883093-0 (rule Win.Packed.Trojanx-9883093-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/Reconyc.DA!MTB (rule Trojan:Win32/Reconyc.DA!MTB) - engine signal, weight 0.55, confidence 0.85
• Detect It Easy (packer/type) flagged DIE:Themida/Winlicense 3.XX (rule DIE:Themida/Winlicense 3.XX) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0, https://d.symcb.com/rpa0@ - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: Themida/VMProtect, high-entropy-sections: , ,.boot, Themida/Winlicense 3.XX - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://d.symcb.com/rpa0
• http://s.symcb.com/universal-root.crl0
• https://d.symcb.com/rpa0@
• http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
• http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0

Embedded domains

• d.symcb.com
• s.symcb.com
• ts-crl.ws.symantec.com
• ts-aia.ws.symantec.com
• pki-crl.symauth.com

More Reconyc samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report