MALICIOUS — a8e57903627b857b4783e54605fe48f33846b99c424418c5fb58d3076fa29416

MALICIOUS — a8e57903627b857b4783e54605fe48f33846b99c424418c5fb58d3076fa29416 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Viking family. 6 of 25 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: a8e57903627b857b4783e54605fe48f33846b99c424418c5fb58d3076fa29416
SHA-1: 9b89ae3f00b8e603fedca2040f0853625b1fd846
MD5: 48c75c74cb301a0ac5d3c84e4761f5f9
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 3072:qKtfDwsjPThTYszDH2fnwbKz275jM99No801zdXnNbIwYyWOkRGiVwasrgJ:BtfDwsjPThT5zL2vPM5C9EmwG
TLSH: T17145AE56822B36A1E1B6DA202C849DDDDC73F46D307AD54C6A03C8AEB2D2D37C8B115D
Submitted as: a8e57903627b857b4783e54605fe48f33846b99c424418c5fb58d3076fa29416
File type: pe · Size: 274312 bytes
Verdict: malicious (100/100) · Family: Viking

Detections (6 of 25 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
YARA: JPCERT/CC: JPCERT_Emotet
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
Microsoft Defender: Virus:Win32/Viking.MS
Emsisoft (Emergency Kit): Trojan.Agent.FPMF
Kaspersky (KVRT): Virus.Win32.Lamer.xe

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

Dropped a malicious payload (Viking): 224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e - dynamic signal, weight 0.80, confidence 0.90
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.MS (rule Virus:Win32/Viking.MS) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.FPMF (rule Trojan.Agent.FPMF) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.xe (rule Virus.Win32.Lamer.xe) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 31 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

55657 behavior events · 2 ATT&CK techniques · 65 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/9241/files/224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e - 224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e
/opt/CAPEv2/storage/analyses/9241/files/089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5 - 089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5
/opt/CAPEv2/storage/analyses/9241/files/645e84f031f2cdd623bb342fa256fe2bb64d4ce4688f0c11a530b602fcbf1db3 - 645e84f031f2cdd623bb342fa256fe2bb64d4ce4688f0c11a530b602fcbf1db3
/opt/CAPEv2/storage/analyses/9241/files/d63702fe0bd5bf7e5cafddd58349a625036e9b70e78d6d80d1d6a897b9dbad28 - d63702fe0bd5bf7e5cafddd58349a625036e9b70e78d6d80d1d6a897b9dbad28
/opt/CAPEv2/storage/analyses/9241/files/aff59f3c2cb1ea93fb65e15b481390c449fb859c8804ce379666d58af113a4ba - aff59f3c2cb1ea93fb65e15b481390c449fb859c8804ce379666d58af113a4ba
/opt/CAPEv2/storage/analyses/9241/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/9241/files/4b4aff4267767008ed9c511c369a6e01000452e5d8e2330d95689af0e35f8756 - 4b4aff4267767008ed9c511c369a6e01000452e5d8e2330d95689af0e35f8756
/opt/CAPEv2/storage/analyses/9241/files/821183c2603bd5e6b268762844a45925764da6ec051dcb69a148dc0327cf8aeb - 821183c2603bd5e6b268762844a45925764da6ec051dcb69a148dc0327cf8aeb
/opt/CAPEv2/storage/analyses/9241/files/bcce98670e14be492001f9eaa24bdbc79542e3a0a0a306e9606dc8de1be3f510 - bcce98670e14be492001f9eaa24bdbc79542e3a0a0a306e9606dc8de1be3f510
/opt/CAPEv2/storage/analyses/9241/files/13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a - 13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a
/opt/CAPEv2/storage/analyses/9241/files/c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc - c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc
/opt/CAPEv2/storage/analyses/9241/files/98948bb68681f3c27710c49481bf91c56b177e64dae91e5704cb71ed6b5e9c3a - 98948bb68681f3c27710c49481bf91c56b177e64dae91e5704cb71ed6b5e9c3a
/opt/CAPEv2/storage/analyses/9241/files/af4c1d1de549cc7999310c4ee9fc5d8ba03e3c29b522ee0a3ebf9fe548bfde98 - af4c1d1de549cc7999310c4ee9fc5d8ba03e3c29b522ee0a3ebf9fe548bfde98
/opt/CAPEv2/storage/analyses/9241/files/0d314ba4c190c9b47945aa09bcf9d37d407f16b94944e5669dcd79245bcd935b - 0d314ba4c190c9b47945aa09bcf9d37d407f16b94944e5669dcd79245bcd935b
/opt/CAPEv2/storage/analyses/9241/files/af9809d2f5f78db7e5bbe36497225f46a820f773710aa2beca4282669f360e73 - af9809d2f5f78db7e5bbe36497225f46a820f773710aa2beca4282669f360e73

Embedded URLs

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786399319&P2=404&P3=2&P4=QjuSuVmEC0SWIijh01atQ%2b4dT%2beRDDiQlBm%2bskkz%2bI4y3E%2bTrFR8FqH%2fm3VhdjWdjSI0%2fnkDAftoXcgyha6Z8Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786399402&P2=404&P3=2&P4=PW%2fMGJWJgJ0Gje64IQ2amSaU%2bGh7uq2cSesK11YKxSpOCQHWrMsHk8bLdKE8RUdQy2BltgPFyJ1mPMr7d0mgvA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.microsoft.com
crl.microsoft.com

Embedded IP addresses

192.168.0.30
192.168.8.1
20.89.1.12
52.123.252.227
203.26.79.13
4.230.171.124
40.84.85.40
52.253.84.76
20.165.94.63
74.179.77.164
52.168.117.175
172.178.240.162
20.165.94.46
172.178.240.163
184.84.165.136
72.145.35.108
52.148.114.188
52.110.12.48
92.223.78.30
52.110.12.38

More Viking samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report