MALICIOUS — af13810dfbfe5277227e9c5f90d3ff9487f2b5ed5c43b6b837ff0a4389cd49b6

MALICIOUS — af13810dfbfe5277227e9c5f90d3ff9487f2b5ed5c43b6b837ff0a4389cd49b6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Cerbu family. 5 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: af13810dfbfe5277227e9c5f90d3ff9487f2b5ed5c43b6b837ff0a4389cd49b6
SHA-1: fefd7f733c430ed1a080013a1e8e994923376f93
MD5: caa65ef541402a4c1a2540b5f6fd30b7
imphash: d9f751f63949720d0576017974a30cea
ssdeep: 98304:4X0SNwAbeiALgbCIAl5sVY/Vz8DcIyUo:Ybbei9CIAuYNGRyUo
TLSH: T1636022067D88ABD6C88C58FF4F4D208F9B4F8684911BE719F2BB41961291782437D86F
Submitted as: af13810dfbfe5277227e9c5f90d3ff9487f2b5ed5c43b6b837ff0a4389cd49b6
File type: pe · Size: 3552256 bytes
Verdict: malicious (99/100) · Family: Cerbu

Detections (5 of 56 engines)

capa (capabilities): capability:execution/powershell
Microsoft Defender: Trojan:Win32/Cerbu.BAA!MTB
Emsisoft (Emergency Kit): Gen:Variant.Lazy.678503
Trellix Stinger (McAfee): Trojan-FXKM!CAA65EF54140
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 13 weighted signals:

Microsoft Defender flagged Trojan:Win32/Cerbu.BAA!MTB (rule Trojan:Win32/Cerbu.BAA!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Lazy.678503 (rule Gen:Variant.Lazy.678503) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FXKM!CAA65EF54140 (rule Trojan-FXKM!CAA65EF54140) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Boot/Logon autostart via Startup folder [medium] (rule tl-bootconf-persistence) - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 7 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

28197 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pInus5wOe.exe - f2b8b7984f97167a0ec55eb345136c87b593fc9abab3f81b0b6da6608fbda587
fe798679eec77d8bc8525981b1e79c8d10c334053d751b2c5397f9b905f43036 - fe798679eec77d8bc8525981b1e79c8d10c334053d751b2c5397f9b905f43036
78e661a948d805bed395430cdaca8ed78532ae83890bf13498888652c4d402b1 - 78e661a948d805bed395430cdaca8ed78532ae83890bf13498888652c4d402b1
3b61174d76f2d884d749f12bd2230983de434ba01380ecade2effc25f70cb821 - 3b61174d76f2d884d749f12bd2230983de434ba01380ecade2effc25f70cb821

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

104.46.162.224
52.123.252.240
4.230.171.124
74.178.240.51
20.42.179.204
52.182.141.63
20.247.184.197
74.178.240.61
20.184.175.8
104.18.33.89
92.223.78.30
52.110.12.44
52.110.12.8
135.234.160.245
172.178.240.162
185.96.88.29
46.101.169.151
37.187.102.186
20.184.175.20
4.150.223.109
163.172.53.84
52.148.114.188
131.188.40.189
72.153.5.61
52.110.12.15

File paths

z:\8

More Cerbu samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report