MALICIOUS — af536f94c27f72452557f6ce3e2adf2b270750b101b00424d29895b9fe8605c7

MALICIOUS — af536f94c27f72452557f6ce3e2adf2b270750b101b00424d29895b9fe8605c7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Finfish family. 5 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: af536f94c27f72452557f6ce3e2adf2b270750b101b00424d29895b9fe8605c7
SHA-1: 3ca0eb42e57a0d5ed48878326e41267d971c0b83
MD5: d10f2b1a69aa5994d4061ea97ef4861f
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 98304:emhd1UryetH+GIoZTVLUjH5oxFbxCVLUjH5oxFbx:elNSoNVUjZEdCVUjZEd
TLSH: T17C6223E953365B4CE0B5C0482B26239D881294D917FF35C2C64FB02FB3EEA5B29511A7
Submitted as: af536f94c27f72452557f6ce3e2adf2b270750b101b00424d29895b9fe8605c7
File type: pe · Size: 4453888 bytes
Verdict: malicious (97/100) · Family: Finfish

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.l2
ClamAV (daily): Win.Trojan.Finfish-9787043-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.Agent.GIKJ
Kaspersky (KVRT): Trojan.Win32.Agent.xaktra

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 97/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Trojan.Finfish-9787043-0 (rule Win.Trojan.Finfish-9787043-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
Packing/obfuscation: high-entropy-sections:.l2 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

183 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\D02C.tmp - a49c4e98ff546bd65ed892af276fd35c0aaa22d6b692fc36f5f0771831a17ee8
a897ae00c1a15a165c7bbf8b10c1102b86e5a778cf64960a5efa8bd30d6620ee - a897ae00c1a15a165c7bbf8b10c1102b86e5a778cf64960a5efa8bd30d6620ee

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787912483&P2=404&P3=2&P4=S%2bHfRgUSnD%2fBfaBhjqB411QM%2boPz5MIddn%2f%2fjUI7jg442w6FRAsklT2ERbgQDODQMrm3okV%2buHq1Z4cSSUGCng%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787912560&P2=404&P3=2&P4=HuPFV9eYBOz3BzzXx9RO2Nc%2fbgHT9AeMAdhjO0oFt4Sei6OanhJPVCgHWVVPs%2bcpstyyDZjcFbu2e6HN2KNZvg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

el.tw
schemas.microsoft.com

Embedded IP addresses

20.184.175.19
52.123.252.223
4.230.171.124
4.247.188.224
52.253.84.76
20.165.94.63
135.232.92.97
20.184.175.13
52.123.252.197
20.76.201.171
162.159.142.9
40.103.64.242
52.123.129.14
52.123.128.14
203.26.79.13
52.110.12.42
52.110.12.50
135.233.45.221
135.232.92.34
52.148.114.188
92.223.78.30
85.210.196.11
72.145.35.101
52.110.12.11
52.110.12.40

File paths

I:\hizh
m:\w\C

More Finfish samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report