MALICIOUS — ab1bb746d7dfcb901f1583858d29ddad35da56eb64b49797efa219281b4c32a8

MALICIOUS — ab1bb746d7dfcb901f1583858d29ddad35da56eb64b49797efa219281b4c32a8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Mbrlock family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: ab1bb746d7dfcb901f1583858d29ddad35da56eb64b49797efa219281b4c32a8
SHA-1: a1333409437583b578cb9c96d7cc7c2915140457
MD5: 33065f7ba6f2c84e72501c67139eba5b
imphash: 8d08b9aff260461badc1821f4f717247
ssdeep: 196608:8Vazg7DSmVazg7DSmYVazg7DSmVazg7DSmL:hg7ufg7u0g7ufg7u8
TLSH: T1926A137E130B7403DE3AD62554862FCD0463BCAD507D5888553B84BE93F6CEB27806AA
Submitted as: ab1bb746d7dfcb901f1583858d29ddad35da56eb64b49797efa219281b4c32a8
File type: pe · Size: 9338880 bytes
Verdict: malicious (100/100) · Family: Mbrlock

Detections (6 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Mbrlock-9779766-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Blocker.EM!MTB
Emsisoft (Emergency Kit): Gen:Variant.Genie.689
Kaspersky (KVRT): HEUR:Trojan.Win32.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Trojan.Mbrlock-9779766-0 (rule Win.Trojan.Mbrlock-9779766-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Dropped a malicious payload: OScam Collection.htm - dynamic signal, weight 0.62, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Blocker.EM!MTB (rule Trojan:Win32/Blocker.EM!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Genie.689 (rule Gen:Variant.Genie.689) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Agent.gen (rule HEUR:Trojan.Win32.Agent.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 21 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

19446 behavior events · 3 ATT&CK techniques · 8 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\7D57AD13E21.exe - 776afd17bce7cc58c933a0e7caef2eb87ec4542d66d1380ace864931e39bb4ba
C:\Users\analyst\AppData\Local\Temp\top2.gif - 7cb06f8dbfa5f13359e2dcee822fae73ef01a00ff29ce99ec401a73017875aee
C:\Users\analyst\AppData\Local\Temp\OScam Collection.htm - fcd785d06efc594628f2460b3098d5b97633f2e4587be0fa50dd8cd60a447407
C:\Users\analyst\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT - b0715c24eef4c3d20c812bb858a4e50569a836f0217c7652fb350be953e5f50d
C:\Users\analyst\AppData\Roaming\Scegli_nome_allegato.exe - ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420
ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49 - ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49
0367653f24003fae1324a91b98f41caabdd5d8578a49132aa0222f02d2a106c5 - 0367653f24003fae1324a91b98f41caabdd5d8578a49132aa0222f02d2a106c5
f647ad5887b1993d77bf5e2e6ab9f8ea77328ccf8f68fb78ffae77c1d8970310 - f647ad5887b1993d77bf5e2e6ab9f8ea77328ccf8f68fb78ffae77c1d8970310

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

hb.za
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
sunray1975.zapto.org

Embedded IP addresses

13.89.179.12
135.232.92.97
40.79.163.155
4.230.171.124
40.84.97.4
74.178.76.128
4.144.132.114
52.168.112.66
52.123.252.225
104.18.33.89
52.148.114.188
92.223.78.30
20.184.175.5
4.150.223.97
72.145.35.110
52.110.12.18
52.110.12.8

File paths

B:\:t:
X:\:`:d:h:l:p:t:
X:\:`:d:h:l:p:t:x:
J:\:`:d:h:
I:\ba

More Mbrlock samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report