MALICIOUS — b2a33b38f8fd574fb80e9df8c4094090365ee7250593e372b854da9757a9a3c0.bin

MALICIOUS — b2a33b38f8fd574fb80e9df8c4094090365ee7250593e372b854da9757a9a3c0.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the InjectorNetT family. 2 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: b2a33b38f8fd574fb80e9df8c4094090365ee7250593e372b854da9757a9a3c0
SHA-1: 4f3152749851fbc40f63d55072cc33b1fe5241a5
MD5: 1962408657914463a66f4d8d3d61b7c7
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 12288:J1NPIHqyhcfrStG/jaleNP6ZkRULsAvyrelkRP+EEXxjuyE4MTDmGxaYwrihM8B:F9FyUEhlZV
TLSH: T1A94E7D8D02240E3DD6B44CAB1C9DA7AE9BDA70486CBE27F44B00C6719851F6748772BD
Submitted as: b2a33b38f8fd574fb80e9df8c4094090365ee7250593e372b854da9757a9a3c0.bin
File type: pe · Size: 640000 bytes
Verdict: malicious (99/100) · Family: InjectorNetT

Source: MalShare · first seen 2026-08-21T12:05:00.676Z · SHA-256 verified

Detections (2 of 55 engines)

capa (capabilities): capability:execution/powershell
Kaspersky (KVRT): UDS:Trojan.MSIL.InjectorNetT.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

Memory forensics: 3 finding(s), e.g. process hollowing in MSBuild.exe (pid 3552) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.70, confidence 0.85
2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 28 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Extracted XWorm config (0 C2) - engine signal, weight 0.45, confidence 0.60
Embedded network infrastructure: 3.3.2.0 - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

14597 behavior events · 3 ATT&CK techniques · 21 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - 4cd3a086f6ae36b696b711cb243d4317ff48bc9b6f1d3b825bc85464bc81c69b
C:\Users\analyst\AppData\Local\Temp\0676d32009bc.tmp - 4b5844479d606951aac5dfff93d6eefbbf9bdf7941ab455ee1e78f6d92d01188
C:\Users\analyst\AppData\Local\Temp\0251098c7f85.tmp - 0b7c3395656eca9b29fab511d158b9ee039d2a2a32ee99d15b7039e60ad216e7
C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_3jsomefl.355.psm1 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
C:\Users\analyst\AppData\Local\Temp\BrightInfo\cache\stub_exe.dat - d43d49e712cae5565ad39edcb77eda8f4211cc30640930078be535568a18bb8f
e74ba75af68cb79d55297558b023f0e7306f82083eef395a962b1181680d84fa - e74ba75af68cb79d55297558b023f0e7306f82083eef395a962b1181680d84fa
c9755626dc83b13f603a7add12ae1e9e3970354b44c707f4ffab459f19ef7315 - c9755626dc83b13f603a7add12ae1e9e3970354b44c707f4ffab459f19ef7315
2f11f4c64635677b83d5452a1ab385c0bd24feca1b678d1c2ed26297325dc849 - 2f11f4c64635677b83d5452a1ab385c0bd24feca1b678d1c2ed26297325dc849
012b2b76dbbf81f228bc265b13038bd57f9ded70cbf6855eb662dd3b06625a97 - 012b2b76dbbf81f228bc265b13038bd57f9ded70cbf6855eb662dd3b06625a97
eca515ca1dfa488d7d08347462017e1dff430be31ce6f994a99ccf47ed6fe200 - eca515ca1dfa488d7d08347462017e1dff430be31ce6f994a99ccf47ed6fe200
c67599e8b9b2cebe716f70cc45f32cac0f9864830ee48967b2ef94a6e5ca05ba - c67599e8b9b2cebe716f70cc45f32cac0f9864830ee48967b2ef94a6e5ca05ba
563e6221c9bf43343c444648440e95b42f61c75210964fa2734a544c56466ea5 - 563e6221c9bf43343c444648440e95b42f61c75210964fa2734a544c56466ea5
3579a247fd89bf0856cf9809939557c222abec6dcd13a34078007550c81a8244 - 3579a247fd89bf0856cf9809939557c222abec6dcd13a34078007550c81a8244
33b4d06662172817757e44a28df466409168c198ecbabfe584890546526eab66 - 33b4d06662172817757e44a28df466409168c198ecbabfe584890546526eab66
6fdb050e633924679f0c4dbcc8213723264a2918fa645cf1e8c2818a888d3c87 - 6fdb050e633924679f0c4dbcc8213723264a2918fa645cf1e8c2818a888d3c87

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787918798&P2=404&P3=2&P4=UTSYW0vPN%2fyYbkZh%2brw%2bLT8HFRqx8d198sjx5guX%2fmF66Ztrhh6XZ%2fx1%2bbrcKZUrRv7L17IhROYooxujlJgmNw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787918885&P2=404&P3=2&P4=e2XpbEvmsw%2b93SonkWkUTIEHvAGfS81bgy7%2f2uAhevliFOfYhareuczzbJj3IV1C9fLUapz7x9B9hj6yHBbbWQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

3.3.2.0
13.89.179.12
52.123.252.192
48.211.4.16
4.230.171.124
52.253.84.76
135.232.92.137
74.179.77.164
20.42.73.27
52.123.128.14
20.236.44.162
52.123.129.14
40.99.134.18
172.178.240.161
162.159.142.9
203.26.79.13
52.148.114.188
52.110.12.11
52.110.12.46
135.233.95.80
172.178.240.163
85.210.193.152
72.153.5.135
51.11.192.49
51.116.253.169

File paths

C:\Users\PC\Desktop\Desktop\ENCDEC\DecryptLib\bin\Debug\CryptoObfuscator_Output\IBar2Double.pdb
C:\Users\Administrator\AppData\Local\LX_CRYPTER\Temp\LX_Rtrf5j00vZ5AI5xa\ILRepack-8180-949444\LX_Rtrf5j00vZ5AI5xa.pdb

More InjectorNetT samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report