MALICIOUS — afa97ec57353cea7fbf81017cb80860840b50a92c70a5bde90412e680d0a1c7f

MALICIOUS — afa97ec57353cea7fbf81017cb80860840b50a92c70a5bde90412e680d0a1c7f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Blocker family. 6 of 56 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: afa97ec57353cea7fbf81017cb80860840b50a92c70a5bde90412e680d0a1c7f
SHA-1: b281201523d70639fb40284846c83a668e4131d7
MD5: e30f168a541e5aca1914c9837e7c23d5
imphash: ea28f662ab831803e9a8c823439760d0
ssdeep: 1536:2UMTIGU8vM3dG7l5rphVgEQF5NM4Jt78eRL2h+nK4h+DkXeof+Kg:2bTIGbvM3dIhVYFU4JtVRqYnKZDkuof8
TLSH: T16F395CAB53551B1DD9F0CD95C828FEAF661AACFA52B91ADC772350335AD088300720B7
Submitted as: afa97ec57353cea7fbf81017cb80860840b50a92c70a5bde90412e680d0a1c7f
File type: pe · Size: 92038 bytes
Verdict: malicious (100/100) · Family: Blocker

Detections (6 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Blocker-391
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
Microsoft Defender: Worm:Win32/Drolnux!pz
Trellix Stinger (McAfee): W32/Worm-FFX!E30F168A541E
Kaspersky (KVRT): Trojan-Ransom.Win32.Blocker.jgb

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 18 weighted signals:

ClamAV (daily) flagged Win.Trojan.Blocker-391 (rule Win.Trojan.Blocker-391) - engine signal, weight 0.90, confidence 0.95
3 behavioral detection(s) across 3 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.66, confidence 0.90
Microsoft Defender flagged Worm:Win32/Drolnux!pz (rule Worm:Win32/Drolnux!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/Worm-FFX!E30F168A541E (rule W32/Worm-FFX!E30F168A541E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Ransom.Win32.Blocker.jgb (rule Trojan-Ransom.Win32.Blocker.jgb) - engine signal, weight 0.55, confidence 0.85
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.55, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.ibayme.eb2a.com/dwn.dmp, http://www.ibayme.eb2a.com/ad.php, 1.9.0.5 - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 17 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

126009 behavior events · 3 ATT&CK techniques · 90 dropped files.

Dropped files

C:\Windows\WinSxS\amd64_microsoft-windows-user-action-sounds_31bf3856ad364e35_10.0.26100.1_none_0d00fa0434e4eab8\Focus0_48000Hz.raw - f68442c0ecae1d1d3bd435b25f1507cc74a4582c10f9567cf3e61d10d2d0d991
C:\Windows\WinSxS\amd64_microsoft-windows-t..peech-en-us-onecore_31bf3856ad364e35_10.0.26100.1_none_f8f09a49f1697814\M1033Zira.keyboard.RAD - 47e33f4fa62eb9177512383aabbb6ff75ca7486d8db4dc5d2e26816712073dcc
C:\Program Files\Windows Media Player\Media Renderer\DMR_48.jpg - e010cdbed55de0c5e76f5431efbb898c8092ca72e3c5a2ad62798956791494ba
C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-c..ragethelpdiagnostic_31bf3856ad364e35_10.0.26100.1_none_a80d3d319006b4ee.manifest - a4a75456e6b5486dbe0a9bd9b882f0da5d27fa32c8770ae96fd0c0d2fba5e5ec
C:\Windows\WinSxS\amd64_microsoft-windows-t..peech-en-us-onecore_31bf3856ad364e35_10.0.26100.1_none_f8f09a49f1697814\M1033David.keyboard.RAD - c28e46bd33f2129cf37cad01715d1ac24156013a0cf5acd6f94b2053e9116261
C:\ProgramData\Microsoft\Windows\AppRepository\Microsoft.RawImageExtension_2.5.24.0_neutral_~_8wekyb3d8bbwe.xml - fe7491bf7fa0d8c16977f76066c296ecb3040b43b1e9d0d676ca280ac2c737da
C:\Program Files\WindowsApps\Microsoft.BingWeather_4.54.63045.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\29.jpg - 401005eb862c6ac5a57cba6ef3e91b380fe4b0a0810aa079e378f384c0f18a53
C:\Windows\WinSxS\amd64_microsoft-windows-devices-radios_31bf3856ad364e35_10.0.26100.8246_none_fc849c86024680fc\Windows.Devices.Radios.dll - fe507242f22060f86c3bcef4c34473dfe46fd8421b01d2086f4e4447eb0ba900
C:\Windows\WinSxS\amd64_microsoft-windows-user-action-sounds_31bf3856ad364e35_10.0.26100.1_none_0d00fa0434e4eab8\GoBack_48000Hz.raw - b3c5a4d6099c4af9f4d8c3df3b4bef2e9a9193bc8c2ede7544e4c6ab4a618b6e
C:\Windows\WinSxS\amd64_microsoft-windows-devices-radios_31bf3856ad364e35_10.0.26100.7920_none_fc37734802807af8\r\Windows.Devices.Radios.dll - b0450f85ceb8c2f01557684133504a0967a3d753b1bf79a6e4979eb6417b6120
C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.8115_none_69a9721261f79982.manifest - 81473a8d4c7eb9d9e769b85aa2d9b77a83df8882530f3eb39756559c5576c376
C:\Program Files\FoxitReader\bin\COM7.EXE - a42a74b6f6711ebc1ca69e68c69d4ef9dd5b5143b33329a1724c6d89d3bff06f
C:\Program Files\WindowsApps\Microsoft.BingWeather_4.54.63045.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\15.jpg - eb17b99a4f8478b2da389343391ebcffaf389256dce178b7a692c00437df9dae
C:\Windows\WinSxS\amd64_microsoft-windows-user-action-sounds_31bf3856ad364e35_10.0.26100.1_none_0d00fa0434e4eab8\Focus2_48000Hz.raw - 57ab9c8a42c55a1a84b3b5e8c7fb15d723bbfb69fafb834002e3228636d8c108
C:\Program Files\WindowsApps\Microsoft.BingWeather_4.54.63045.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\46.jpg - 830309773609f2a5dab3ee6ef0b782d890fb7f7c0a24e0cbddc2211e8f96a926

Embedded URLs

http://www.ibayme.eb2a.com/dwn.dmp
http://www.ibayme.eb2a.com/ad.php
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.ibayme.eb2a.com
s.com

Embedded IP addresses

1.9.0.5
4.150.223.103
4.144.132.223
52.230.60.54
4.230.171.124
52.253.84.76
104.18.33.89
162.159.142.9
52.168.112.66
51.104.15.252
135.234.160.244
52.148.114.188
92.223.78.30
52.110.12.54
52.110.12.26

Registry keys

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

File paths

c:\windows\system32\syssh32.dll
C:\RECYCLER\bilbilal.exe
C:\MusicMP3
c:\WINDOWS\system32\shell32.dll

More Blocker samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report