MALICIOUS — aba8f985a4f7a65d30a430400962bec72ad6f33ad8c6622c39b62927cd6423b0

MALICIOUS — aba8f985a4f7a65d30a430400962bec72ad6f33ad8c6622c39b62927cd6423b0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AB9A06E4 family. 6 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: aba8f985a4f7a65d30a430400962bec72ad6f33ad8c6622c39b62927cd6423b0
SHA-1: cbaa940fed90a336ec01d303f0aa1d4e0f979037
MD5: ed7ac29ae6ad60ffc8cee8b972c8dea9
imphash: 532816589b7c9c3bed0fbcc3d1503ba1
ssdeep: 3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/B8dC3vgQBFbpl:o68i3odBiTl2+TCU/oQBFbJQBFb6
TLSH: T188438E6E0F1B3B02C233CB605D415F8E4462B46AB17D55884B13D03EA6FFC97AA6125E
Submitted as: aba8f985a4f7a65d30a430400962bec72ad6f33ad8c6622c39b62927cd6423b0
File type: pe · Size: 238643 bytes
Verdict: malicious (100/100) · Family: AB9A06E4

Detections (6 of 52 engines)

ClamAV (daily): Win.Worm.Nupik-1
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
Microsoft Defender: Worm:Win32/Delf.BE!MTB
Emsisoft (Emergency Kit): Dropped:Generic.Malware.SV!p2p!u.AB9A06E4
Kaspersky (KVRT): P2P-Worm.Win32.VB.dz

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Worm.Nupik-1 (rule Win.Worm.Nupik-1) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Worm:Win32/Delf.BE!MTB (rule Worm:Win32/Delf.BE!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dropped:Generic.Malware.SV!p2p!u.AB9A06E4 (rule Dropped:Generic.Malware.SV!p2p!u.AB9A06E4) - engine signal, weight 0.55, confidence 0.85
Dropped a suspicious payload: 3959c5532031a58119c317dda15ac9313505df4a92c004cd2e76b071b0fad4a4 - dynamic signal, weight 0.50, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 42 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: 3.6.1.0, 5.0.3.6 - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

11195 behavior events · 2 ATT&CK techniques · 11 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/10710/files/67bc1cd876f5059789b0dc8dc16c0b2155e55aca8d1c8439d70c8882e1875740 - 67bc1cd876f5059789b0dc8dc16c0b2155e55aca8d1c8439d70c8882e1875740
/opt/CAPEv2/storage/analyses/10710/files/3959c5532031a58119c317dda15ac9313505df4a92c004cd2e76b071b0fad4a4 - 3959c5532031a58119c317dda15ac9313505df4a92c004cd2e76b071b0fad4a4
/opt/CAPEv2/storage/analyses/10710/files/6d9073bb2d45aacf1731fb69566c03e6579ca45091364a7aad07880554ae99b2 - 6d9073bb2d45aacf1731fb69566c03e6579ca45091364a7aad07880554ae99b2
/opt/CAPEv2/storage/analyses/10710/files/0df5c718b7aee9f045f804f6a53cb0727f66e1ac1df612c6ecf342aed81ce130 - 0df5c718b7aee9f045f804f6a53cb0727f66e1ac1df612c6ecf342aed81ce130
/opt/CAPEv2/storage/analyses/10710/files/00a339ff5338d0cfe91b262175eef4e5fd07f9d28e8f980a1f5ff43a5a81e597 - 00a339ff5338d0cfe91b262175eef4e5fd07f9d28e8f980a1f5ff43a5a81e597
/opt/CAPEv2/storage/analyses/10710/files/71acc5a88debfdba0eed23272ef4b09fd6609eeb4b1ec457c72444472ad8b3a4 - 71acc5a88debfdba0eed23272ef4b09fd6609eeb4b1ec457c72444472ad8b3a4
/opt/CAPEv2/storage/analyses/10710/files/f8e799b6ff26eae5c107e188bfd8fbadafafc4e90c830527757e066916a03df1 - f8e799b6ff26eae5c107e188bfd8fbadafafc4e90c830527757e066916a03df1
/opt/CAPEv2/storage/analyses/10710/files/d2770f68db717c5335ceca3f2b0be1e294839a4904d3525f4c5e9847654d39c2 - d2770f68db717c5335ceca3f2b0be1e294839a4904d3525f4c5e9847654d39c2
/opt/CAPEv2/storage/analyses/10710/files/adb0b5eb4fcfcc55c40eaa2ba3d142ed413293b2212bb2a1ddd8ed062db004bf - adb0b5eb4fcfcc55c40eaa2ba3d142ed413293b2212bb2a1ddd8ed062db004bf
/opt/CAPEv2/storage/analyses/10710/files/76f05dd79b2d3a08baf928e4811b0f179e96ac351ff8007f2e24f5fbb4b95253 - 76f05dd79b2d3a08baf928e4811b0f179e96ac351ff8007f2e24f5fbb4b95253
/opt/CAPEv2/storage/analyses/10710/files/462d333fc849166df8cb4e9ba6edd8404f4d79ebcd535125ecb5e8fe9d2cc0e0 - 462d333fc849166df8cb4e9ba6edd8404f4d79ebcd535125ecb5e8fe9d2cc0e0

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786459994&P2=404&P3=2&P4=dLfnOjr22Cf3f62NwWdfQPWzumEeWOseAML6Ke5Xw5CIPTy0ISzahecu7kMr77JfO7wCHoWkK9FrnTSSqJPL8w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786460018&P2=404&P3=2&P4=HpI79aTfGEmsnWkO76BjDNbKnt9Lh7NB0eALRfBF%2fyLy7U6Qpoab5PqSPZRAZ%2f2kFMaFSo1U4oPg7bqZjbR1Rg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

3.6.1.0
5.0.3.6
52.110.12.40
52.110.12.54
74.179.71.159
40.79.163.154
4.144.132.223
4.230.171.124
57.154.63.210
74.179.77.204
74.178.76.54
20.42.73.28
74.178.240.61
135.234.160.246
172.178.240.163
203.26.79.13
52.123.252.194
52.123.252.220
48.211.4.16
4.247.188.233
104.46.162.230
20.184.175.18
72.153.5.138
52.148.114.188
92.223.78.30

File paths

C:\Programme\eMule

More AB9A06E4 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report