MALICIOUS — a9d35fd8899a1d2fb7443f59945d9ea098aff1962750624839533a6bf9fae793

MALICIOUS — a9d35fd8899a1d2fb7443f59945d9ea098aff1962750624839533a6bf9fae793 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Autorun family. 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: a9d35fd8899a1d2fb7443f59945d9ea098aff1962750624839533a6bf9fae793
SHA-1: 73331a638ebe7349a32a154c2562b1dad29a3c6e
MD5: cf60338f92a33ea6e33642ae9d3a0aff
imphash: 43df92b7b77db2760430968647afb835
ssdeep: 3072:5fQgicdlGvILcU9KQ2BBAkJaPxnIolH8ha22XX/xFV:/icdlG5WKQ2BjGxpspY/rV
TLSH: T16A449DD5B104A75EFE230FCB44A26F1DA442A0F814E04D45AEC7DD689B30CAFA4D16E6
Submitted as: a9d35fd8899a1d2fb7443f59945d9ea098aff1962750624839533a6bf9fae793
File type: pe · Size: 245472 bytes
Verdict: malicious (100/100) · Family: Autorun

Detections (6 of 56 engines)

ClamAV (daily): Win.Dropper.LokiBot-9866840-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Worm:Win32/Ganelp!pz
Emsisoft (Emergency Kit): Trojan.Generic.7604330
Trellix Stinger (McAfee): W32/Autorun.worm.aacd
Kaspersky (KVRT): Worm.Win32.Juched.fkf

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Dropper.LokiBot-9866840-0 (rule Win.Dropper.LokiBot-9866840-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Worm:Win32/Ganelp!pz (rule Worm:Win32/Ganelp!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Generic.7604330 (rule Trojan.Generic.7604330) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/Autorun.worm.aacd (rule W32/Autorun.worm.aacd) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.Juched.fkf (rule Worm.Win32.Juched.fkf) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

48952 behavior events · 3 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Program Files (x86)\800e9cf7\800e9cf7 - 3ef9ff5da8272fd1b14c83f12c8d28fd9dbf32d56bcb714921032b02557fe789
C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\d42cc0c3858a58db2db37658219e6400_ebb72558-8201-4ef2-bdc1-5785f9d685a3 - ae0126390fec18ee2643da380a54a2b1127843f03ca7145690f086cdbc05a706
C:\Windows\Tasks\Update23.job - eeda903c84d4fc24b8563995e97fc6992475a5a4b16a6f16db52fc852612f5ea
C:\Program Files (x86)\800e9cf7\jusched.exe - 1bdb335683ad4de41863c6d32826f2a50cf6a2ff6fcd0c44bc728f8f27751e88

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

ftp.byethost12.com
griptoloji.host-ed.net
ftp.tripod.com

Embedded IP addresses

20.184.175.19
20.247.185.124
52.123.252.212
4.230.171.124
172.64.154.167
20.165.94.54
20.42.179.204
135.232.92.137
4.150.223.114
52.110.12.26
52.110.12.31
185.27.134.11
135.233.45.221
52.110.12.21
52.148.114.188
72.153.5.96
52.110.12.32

More Autorun samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report