MALICIOUS — virussign.com_92f7d9b559e6e2de961d17f1e6a6fec0.vir

MALICIOUS — virussign.com_92f7d9b559e6e2de961d17f1e6a6fec0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the CeeInject family. 5 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: adaa5fcfcb3926aae068801ce337c873c4f96e4684ad117b24381faeb467e278
SHA-1: 8131e09d5c65f4366dce8d3f2a4e6451fd4e9641
MD5: 92f7d9b559e6e2de961d17f1e6a6fec0
imphash: 118eb37b88640d7f3f7ac979ea5687cc
ssdeep: 384:yVxXXS3WyzLeReRhnnh5vWRmZO1sTiSExALcDorYRUDjCTxZjQnr+yf7bcE8g:sANich5uRR1VNAe3qnrhf78g
TLSH: T1EA302899CB109A6DD197B50234D74A9EF52223AEF468D8BB14C483308DF09337D31EA5
Submitted as: virussign.com_92f7d9b559e6e2de961d17f1e6a6fec0.vir
File type: pe · Size: 36864 bytes
Verdict: malicious (100/100) · Family: CeeInject

Detections (5 of 52 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Rubinurd-67
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
Microsoft Defender: VirTool:Win32/CeeInject.gen!DU
Kaspersky (KVRT): HEUR:Trojan-Ransom.Win32.Blocker.gen

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Trojan.Rubinurd-67 (rule Win.Trojan.Rubinurd-67) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged VirTool:Win32/CeeInject.gen!DU (rule VirTool:Win32/CeeInject.gen!DU) - engine signal, weight 0.55, confidence 0.85
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (windows)

134 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/6333/files/6bfc1f79a3102addb6a483caf81f4d11d7e559bbfa5739111b0469c3532b1f6e - 6bfc1f79a3102addb6a483caf81f4d11d7e559bbfa5739111b0469c3532b1f6e

Embedded IP addresses

162.159.36.2

Registry keys

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

File paths

c:\temp\2015-05-01_22-53-25.dmp

More CeeInject samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report