MALICIOUS — afa5fa3035047aa871d5155369cee03c353a3ed8dfe24fa5c315a0ffc7e0765d

MALICIOUS — afa5fa3035047aa871d5155369cee03c353a3ed8dfe24fa5c315a0ffc7e0765d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Vindor family. 5 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: afa5fa3035047aa871d5155369cee03c353a3ed8dfe24fa5c315a0ffc7e0765d
SHA-1: 649dbfb1557b7dec9f147590b4e4b6dc7d79abc2
MD5: 10b451b758af74fd364a11195a94c24b
imphash: 895fbb56c02c3d2bca3125cef5da8730
ssdeep: 24576:zeFZcGeDdF364C12SDnnrM+2rOzFabDA0HvkUYIVYZeVwfQkrKJFWxDrpsQTSari:z3NK4Afy
TLSH: T1B85FF946743A81CCF5DCCBB9657CEC5C97B432E6EE6809079885A8258289DDFC9C36C0
Submitted as: afa5fa3035047aa871d5155369cee03c353a3ed8dfe24fa5c315a0ffc7e0765d
File type: pe · Size: 3407872 bytes
Verdict: malicious (99/100) · Family: Vindor

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Generic-9891012-0
Detect It Easy (packer/type): DIE:MinGW
Microsoft Defender: Trojan:Win32/Vindor!pz
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Generic-9891012-0 (rule Win.Malware.Generic-9891012-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Terminates Browser, Office or Security Processes [medium] (rule tl-process-kill) - dynamic signal, weight 0.40, confidence 0.90
Contacted 56 external host(s) at runtime (26 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1622, T1082 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MinGW (rule DIE:MinGW) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, MinGW - static signal, weight 0.25, confidence 0.55
Dropped 15 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

43403 behavior events · 2 ATT&CK techniques · 28 dropped files.

Dropped files

C:\Windows\System32\opencl.dll - 5a2681077bdf69c1306e2be79ba4ff9b69b71c0cfdf96f338ba339e4fe01d758
C:\Windows\Professional.xml - af979d34a75db13c367cd27480ae79720b050d3777b665d00350f717d2409a27
C:\Windows\SysmonDrv.sys - 382c4f3e49420f052d9d02d61aaebc85f91e19e9526465c71c6463f80fdcea2b
C:\Windows\System32\vcruntime140.dll - 4f27c462e51db54dd661b090ad3776731b548ffe82773fd0bf110373b6afa25f
C:\Windows\win.ini - ec3b6bcee1799549f32d9eb465c1080ec8c3d516abe9f28d972e61be69ce4658
C:\Windows\System32\license.rtf - 621b6e9483879229ec1b1c0447f6017eef7976e179daaab5b497a30f465058cf
C:\Windows\System32\concrt140.dll - 7b12b90e216d92602e9d081cc9347e186cb018bed1d27f1978a964877e5755f5
C:\Windows\System32\NOISE.DAT - 7dad138d19584cf9168421eb8e4a0bf6d17d2c9e81b3e4215f699fe4a6949b93
C:\Windows\lsasetup.log - 1b55ddec17534a97d693db3dac793e91dd7d7caf14408fc6fb422a2e6a7db60b
C:\Windows\System32\msvcp140_2.dll - 87b579c21e37bb68f9954985354c8584ce0bb4791488d11bc67d18635e7379f9
C:\Windows\System32\msvcp140_atomic_wait.dll - 30cf45656d4b8b838a59f2b753bcd5f2d74f21819482e3de913646c7dcadb9db
C:\Windows\System32\msvcp140.dll - 2a0a4454bcdaed04ce9b0de0d78713833b937c70ab03d9e855ec7a503cd2cf4b
C:\exc.exe - cbb6cfd32d9331cf1c68ee8e8a73fbb1415202ea437ceb90ba8570477f8c43f5
C:\Windows\System32\mmc.exe.config - df049842d4755987c0e15b5cc70c900a1250d7cc65f9c66bd0713fd5138df1ef
C:\Windows\WindowsUpdate.log - e20b072714f4f15fe6a479bd8df640b211590ac5badbca3f0f23e930d5b02bc3

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787937090&P2=404&P3=2&P4=inVa8cKH3PyQA%2b%2fXyq8BImAv7ctzf2BFf8jL1Gzpu4bi319zzHg%2ft3SikBCKbwWNO8zGB0QVGGz%2bKyeThZUDaA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://www.freeav.com/
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787937173&P2=404&P3=2&P4=QEUjJq%2bapsTKfDOBetX1sTx6v7UuhqRa%2bUT9QnzMKoDekxNjFg6RiM1JMLWYAEtxWKuqKW%2fQoPIQzIClOcflYA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.freeav.com
www.avira.com
script.crazyegg.com
nexus.ensighten.com
assets.adobedtm.com
t.nc0.co
www.webassetscdn.com
s.go-mpulse.net
widget.trustpilot.com
doh.cq0.co
data.privacy.ensighten.com
dpm.demdex.net
symantec.demdex.net
symantec.tt.omtrdc.net
www.nortonlifelock.com
rmbyy5ra.avira.com
mhubc.avira.com
oms.avira.com
getrockerbox.com
www.antispyware.com
img6.wsimg.com
img1.wsimg.com
pagead2.googlesyndication.com
secure.quantserve.com
bzrcdn.openai.com

Embedded IP addresses

40.79.163.155
57.155.101.212
52.123.252.224
20.247.184.197
4.230.171.124
135.232.92.137
85.210.196.11
52.168.117.174
74.178.76.54
52.123.129.14
20.236.44.162
52.123.128.14
74.178.240.61
20.42.73.31
52.123.252.194
52.123.252.222
203.26.79.13
135.234.160.246
74.179.71.159
52.110.12.2
52.110.12.15
20.89.1.8
52.148.114.188
135.234.160.245
52.58.28.12

More Vindor samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report