MALICIOUS — ae66e009e16f0fad3b70ad20801f48f2edb904fa5341a89e126a26fd3fc80f75

MALICIOUS — ae66e009e16f0fad3b70ad20801f48f2edb904fa5341a89e126a26fd3fc80f75 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the FileCoder family. 12 of 51 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: ae66e009e16f0fad3b70ad20801f48f2edb904fa5341a89e126a26fd3fc80f75
• SHA-1: 60053d661ed03cd2a07f6750532e6ef11abcc4e5
• MD5: 03b76a5130d0df8134a6bdea7fe97bcd
• imphash: d41d8cd98f00b204e9800998ecf8427e
• ssdeep: 3072:P6seqCp31Hgsp9a9GTrda8CAKLTsWkyc:CqCp31Z9a9GTrk8CV/t
• TLSH: T1D03B39CD032D07AED6378FAA0DA0A68F94E296D4EAF03B251700083B7590D77547B56B
• Submitted as: ae66e009e16f0fad3b70ad20801f48f2edb904fa5341a89e126a26fd3fc80f75
• File type: pe · Size: 102400 bytes
• Verdict: malicious (100/100) · Family: FileCoder

Detections (12 of 51 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• capa (capabilities): capability:execution/powershell
• MalwareAnalyser heuristics (entropy/packer): Unknown
• ClamAV (daily): {MD5}bin.ransomware.thanos.7487.UNOFFICIAL
• YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
• YARA: Yara-Rules community: YR_AntiVM_Sandbox
• Cyble Vision: Cyble Vision: Malicious
• Detect It Easy (packer/type): DIE:Unknown
• Microsoft Defender: Ransom:MacOS/FileCoder
• Emsisoft (Emergency Kit): Trojan.Ransomware.DT

MITRE ATT&CK

• T1059.001
• T1497
• T1057
• T1055

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

• ClamAV (daily) flagged {MD5}bin.ransomware.thanos.7487.UNOFFICIAL (rule {MD5}bin.ransomware.thanos.7487.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Cyble Vision flagged Cyble Vision: Malicious (rule Cyble Vision: Malicious) - engine signal, weight 0.90, confidence 0.95
• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• Microsoft Defender flagged Ransom:MacOS/FileCoder (rule Ransom:MacOS/FileCoder) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Ransomware.DT (rule Trojan.Ransomware.DT) - engine signal, weight 0.55, confidence 0.85
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiVM_Sandbox (rule YR_AntiVM_Sandbox) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:Unknown (rule DIE:Unknown) - engine signal, weight 0.35, confidence 0.70
• query domain / anti-analysis (rule query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60
• Packing/obfuscation: Unknown - static signal, weight 0.25, confidence 0.55
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded IP addresses

• 255.255.255.0

More FileCoder samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report