MALICIOUS — aa489617bb820737d6dd06602472569fe4b20694f062479927f5974a3636af53

MALICIOUS — aa489617bb820737d6dd06602472569fe4b20694f062479927f5974a3636af53 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the 8D3133A2 family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: aa489617bb820737d6dd06602472569fe4b20694f062479927f5974a3636af53
SHA-1: 7b7bb1c8f562c19dce0ef37679795c7c2ea4fda0
MD5: b8097d6d8713e4d266831bd23a4f7642
imphash: c2a87fabf96470db507b2e6b43bd92eb
ssdeep: 1536:T/D76aqIn0K5ow8W6uHdNld1bIe46gEb:Gan0+wu31bIeH
TLSH: T1EC361749CF452247EEB783C6C6E6FE9FD98C946839F4EA6496EDF0482450087E1850EC
Submitted as: aa489617bb820737d6dd06602472569fe4b20694f062479927f5974a3636af53
File type: pe · Size: 65536 bytes
Verdict: malicious (99/100) · Family: 8D3133A2

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Crypted-31
Microsoft Defender: Backdoor:Win32/Berbew!pz
Emsisoft (Emergency Kit): GenPack:Generic.Dacic.1.Backdoor.Hangup.A.8D3133A2
Trellix Stinger (McAfee): Trojan-FUGH!B8097D6D8713
Kaspersky (KVRT): Trojan-Proxy.Win32.Qukart.vjh

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Trojan.Crypted-31 (rule Win.Trojan.Crypted-31) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Backdoor:Win32/Berbew!pz (rule Backdoor:Win32/Berbew!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged GenPack:Generic.Dacic.1.Backdoor.Hangup.A.8D3133A2 (rule GenPack:Generic.Dacic.1.Backdoor.Hangup.A.8D3133A2) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FUGH!B8097D6D8713 (rule Trojan-FUGH!B8097D6D8713) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Proxy.Win32.Qukart.vjh (rule Trojan-Proxy.Win32.Qukart.vjh) - engine signal, weight 0.55, confidence 0.85
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Dropped 124 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 4 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

4025 behavior events · 1 ATT&CK techniques · 124 dropped files.

Dropped files

C:\Windows\System32\Aghaki32.dll - 508a08988fd9949cbb895740a7c34770e10703d0f25897dabffd3738b66ca90a
C:\Windows\System32\Jeehnm32.exe - 8e4f262b08dfcee39ce5a744032e775c530a24c55c3441ece6d7c69818a28e9c
C:\Windows\System32\Jjinpe32.exe - b3d75e130454982fb9a2430bd2cd462a11ad41bf395f70447fdcc90fde318f82
C:\Windows\System32\Lmlecg32.exe - ed4c0c027d8ec8ffacecf6d39f13224a4ded22a16c5f44fedb3ab0362023aad7
C:\Windows\System32\Jfadpp32.exe - ec578e02d7062c5d029c84282cbb583b8413f652e1dbe4956fc2e07009c59290
C:\Windows\System32\Jdknmhhf.exe - 4b99370ed9b5b946706bbcbeefb95a97f450fe112de5cdbf9fcc4a01205483bf
C:\Windows\System32\Hgfdglmm.dll - 6cac8b16932da5fe980ff0204572e7e01ef5f4a26031d3b7db895d3d436fc33c
C:\Windows\System32\Impmak32.exe - e26492ece952a5a370970e0273b320dee998febe7080fa215d4d7cbdff67ae85
C:\Windows\System32\Lalkoe32.exe - 4b7b08a64f7084a0745d6a21c37905ef588be6390b7e6d3d04855f3576a324bc
C:\Windows\System32\Nnficm32.dll - ab6236b794432f0bf9b929434311de13597816ed649d89a8fa7c7b83e22910c3
C:\Windows\System32\Lqcnci32.dll - 44556e8d24ae0cd1d8140ecdfece26c6a7611c0d5b3f7893781eb146ffb4c746
C:\Windows\System32\Kbofgj32.dll - 4164012650fa540dfbf557b07a584652e6b12bebb312a3ac0339d83c3188d6f2
C:\Windows\System32\Kjmkpaea.dll - e7bddcd33722fff28bd7f9a999fa350b3c837719b0a075c942ea43a39b680c26
C:\Windows\System32\Nlelcb32.exe - 2990762878b5cd3c627614c4da99e3886b6c1ed1bf8d59b271d6f8fe5cf38772
C:\Windows\System32\Hlbfikla.dll - 52ed33add75dca78ed2a153e02ee1ac675572f382263e56ee0149cb12d2560fe

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

40.74.98.198
4.144.132.223
4.230.171.124
135.234.160.246
172.215.188.232
40.84.97.4
52.148.114.188
52.110.12.1
52.110.12.15

More 8D3133A2 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report