MALICIOUS — adecaa914cc103938c7d52e46c178f0677300636d4e56f65237ce261d27115c1

MALICIOUS — adecaa914cc103938c7d52e46c178f0677300636d4e56f65237ce261d27115c1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Wacatac family. 5 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: adecaa914cc103938c7d52e46c178f0677300636d4e56f65237ce261d27115c1
SHA-1: 2a792fb6aa808c9d35e117c9c98ec1ef613f8cca
MD5: 4f706ac43cb63275bd5f4bd698a6e28b
imphash: 4d8d0261016c5c05b880950a5b0e704a
ssdeep: 12288:C54G2nCiYtnK4L2yJlH2aY7XcTCMcell0fP0Y3lwKBWjjU/ifaw5idu0w6:C54GXiEK4L2y3HqqdDH0Xfly3UqPt05
TLSH: T15D53BE98A7237816D0AB3B908FB24EAE40455723583C578FDE3B916B0E5797FA130346
Submitted as: adecaa914cc103938c7d52e46c178f0677300636d4e56f65237ce261d27115c1
File type: pe · Size: 1036288 bytes
Verdict: malicious (99/100) · Family: Wacatac

Detections (5 of 52 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Generic-9907165-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Wacatac.B!ml
Kaspersky (KVRT): UDS:Virus.Win32.Agent.ev

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9907165-0 (rule Win.Trojan.Generic-9907165-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 7 finding(s), e.g. RWX/private injected region in powershell.exe (pid 2568) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Wacatac.B!ml (rule Trojan:Win32/Wacatac.B!ml) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Virus.Win32.Agent.ev (rule UDS:Virus.Win32.Agent.ev) - engine signal, weight 0.55, confidence 0.85
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 25 external host(s) at runtime (12 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.eyuyan.com - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.eyuyan.com
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786447136&P2=404&P3=2&P4=bX%2fl9CKvOmWpNmIJq6so4PTnRfnLg%2b1gc2cK4gQDeGeS42mmXbGW96uRQb%2fLJXiDbR2o16ctrzIX68JYqSzQZw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786447154&P2=404&P3=2&P4=R%2b%2bpf2Kt2gWsuBrMCyTDt%2bQqu7GK1p5CpWg42qP%2bQz0sMklNAfIXfTseXKdsYgdh1bYu%2bcAQn8Uilh%2fOmFA2Ew%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
www.eyuyan.com

Embedded IP addresses

20.42.73.31
4.230.171.124
20.42.179.204
4.144.132.114
74.178.240.61
74.179.77.164
74.178.232.29
4.207.44.66
203.26.79.13
51.104.15.253
172.178.240.162
52.110.12.24
92.223.78.30
72.145.35.97
52.110.12.1

More Wacatac samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report