MALICIOUS — RealSetup_a14070b008b49ef8bc14a2d9736df6e2a9762decc75ef9912a6828fe0ddcf5c4.exe
MALICIOUS — RealSetup_a14070b008b49ef8bc14a2d9736df6e2a9762decc75ef9912a6828fe0ddcf5c4.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Smuggling family. 9 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.
Identification
- SHA-256:
b411b444682179bf2f4270fbc22d9a86263b659152f9611712ec40101a8f3aee - SHA-1:
bb5bc882d52a5c342ab214df7de170e7d2f4769a - MD5:
d81c13e9063abe4687060d633ff1f701 - imphash:
bcee585aa18a112c98d41b5e7c5e8e7b - ssdeep:
393216:8OtYCUkjbi+D014Buf8uKzYYlAbf4EOUYNOUY:NWqgQEY - TLSH:
T1D470BF2146572111E1F7E815BC048EECC8B6B0AC6A75E98E9303EC1B91BDE37D1F51A8 - Submitted as: RealSetup_a14070b008b49ef8bc14a2d9736df6e2a9762decc75ef9912a6828fe0ddcf5c4.exe
- File type: pe · Size: 17304576 bytes
- Verdict: malicious (100/100) · Family: Smuggling
Detections (9 of 56 engines)
- YARA: MalwareAnalyser built-in: Suspicious_PowerShell_Download_Exec
- capa (capabilities): capability:execution/powershell
- YARA: delivr.to detections: DLV_HTML_Smuggling
- YARA: ESET research: mimban
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Microsoft Defender: Trojan:Win32/Kepavll!rfn
- Emsisoft (Emergency Kit): Generic.Dacic.21387.D686FB73
- Kaspersky (KVRT): Trojan.Win32.Posprefer.e
MITRE ATT&CK
YARA
- Suspicious_PowerShell_Download_Exec
Why this verdict
The malicious score of 100/100 is the fusion of 15 weighted signals:
- Encoded/hidden PowerShell download-and-exec (rule
Suspicious_PowerShell_Download_Exec) - yara signal, weight 0.70, confidence 0.90 - YARA: delivr.to detections flagged DLV_HTML_Smuggling (rule
DLV_HTML_Smuggling) - engine signal, weight 0.70, confidence 0.70 - YARA: ESET research flagged mimban (rule
mimban) - engine signal, weight 0.70, confidence 0.70 - Microsoft Defender flagged Trojan:Win32/Kepavll!rfn (rule
Trojan:Win32/Kepavll!rfn) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Generic.Dacic.21387.D686FB73 (rule
Generic.Dacic.21387.D686FB73) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Trojan.Win32.Posprefer.e (rule
Trojan.Win32.Posprefer.e) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - execute via PowerShell (rule
execute via PowerShell) - capa signal, weight 0.40, confidence 0.80 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - YARA: MalwareAnalyser built-in flagged Suspicious_PowerShell_Download_Exec (rule
Suspicious_PowerShell_Download_Exec) - engine signal, weight 0.35, confidence 0.70 - capa (capabilities) flagged capability:execution/powershell (rule
capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: https://curl.se/docs/caextract.html, https://1.1.1.1/dns-query, https://8.8.8.8/dns-query - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://github.com/dot-asm
- https://curl.se/docs/caextract.html
- https://raw.githubusercontent.com/mozilla-firefox/firefox/refs/heads/release/security/nss/lib/ckfw/builtins/certdata.txt
- https://1.1.1.1/dns-query
- https://8.8.8.8/dns-query
- https://9.9.9.9/dns-query
- https://curl.se/docs/http-cookies.html
- https://curl.se/docs/alt-svc.html
- https://curl.se/docs/hsts.html
- https://download.projectreal.live/
- https://dl.projectreal.live/
- https://api.projectreal.live/
- http://www.w3.org/2000/svg
- https://ca.trufo.ai/c2pa-ca.crt03
- https://ca.trufo.ai/root-ca.crt0
- http://www.w3.org/1999/xlink
- http://www.w3.org/XML/1998/namespace
- https://api.projectreal.live/update/check
- https://projectreal.gg
- https://download.projectreal.live/verify
- https://dl.projectreal.live/verify
- https://discord.gg/projectreal
- https://projectreal.gg/download
- https://go.microsoft.com/fwlink/?linkid=2124701
- https://go.microsoft.com/fwlink/p/?LinkId=2124703
Embedded domains
- github.com
- curl.se
- raw.githubusercontent.com
- mk-ca-bundle.pl
- api.projectreal.live
- download.projectreal.live
- dl.projectreal.live
- projectreal.live
- example.com
- www.w3.org
- cv.iptc.org
- ca.trufo.ai
- trufo.ai
- x.no
- this.name
- t.name
- i.name
- e.payload.name
- a.to
- this.sh
- this.ir
- e.ir
- t.sh
- this.or.sh
- e.ml
Embedded IP addresses
- 104.26.10.42
- 104.26.11.42
- 172.67.68.127
- 1.1.1.1
- 8.8.8.8
- 9.9.9.9
- 1.101.3.4
- 12.2.2.8
- 12.2.1.16
- 5.3.1.9
- 61.1.1.1
- 1.9.16.3
- 4.1.188.7
- 1.0.0.1
File paths
- C:\Users\Marko\Documents\Roblox\Scripts\GitHub-Repos\Real-Executor\Real-Setup\vcpkg\buildtrees\curl\src\url-8_20_0-f25c438caa.clean\lib\vtls\openssl.c
- C:\Users\Marko\Documents\Roblox\Scripts\GitHub-Repos\Real-Executor\Real-Setup\vcpkg\buildtrees\openssl\x64-windows-static-rel\include\internal/packet.h
- C:\Users\Marko\Documents\Roblox\Scripts\GitHub-Repos\Real-Executor\Real-Setup\vcpkg\buildtrees\openssl\x64-windows-static-rel\include\internal/ring_buf.h
- C:\\Program
- C:\Program
- C:\Users\Marko\Documents\Roblox\Scripts\GitHub-Repos\Real-Executor\Real-Setup\vcpkg\buildtrees\openssl\x64-windows-static-rel\crypto\err\err_local.h
- C:\Users\Marko\Documents\Roblox\Scripts\GitHub-Repos\Real-Executor\Real-Setup\vcpkg\buildtrees\openssl\x64-windows-static-rel\engines\e_capi_err.c
- C:\Users\Marko\Documents\Roblox\Scripts\GitHub-Repos\Real-Executor\Real-Setup\vcpkg\buildtrees\openssl\x64-windows-static-rel\providers\implementations\ciphers\cipher_aes_cts.inc
- C:\Users\Marko\Documents\Roblox\Scripts\GitHub-Repos\Real-Executor\Real-Setup\vcpkg\buildtrees\openssl\x64-windows-static-rel\providers\implementations\ciphers\cipher_camellia_cts.inc
- C:\Users\Marko\Documents\Roblox\Scripts\GitHub-Repos\Real-Executor\Real-Setup\vcpkg\buildtrees\openssl\x64-windows-static-rel\providers\implementations\include\prov/blake2_params.inc
- C:\Users\Marko\Documents\Roblox\Scripts\GitHub-Repos\Real-Executor\Real-Setup\vcpkg\buildtrees\openssl\x64-windows-static-rel\providers\implementations\macs\blake2_mac_impl.c
- C:\Users\Marko\Documents\Roblox\Scripts\GitHub-Repos\Real-Executor\Real-Setup\vcpkg\buildtrees\openssl\x64-windows-static-rel\providers\implementations\ciphers\cipher_aes_hw_aesni.inc
- C:\Users\Marko\Documents\Roblox\Scripts\GitHub-Repos\Real-Executor\Real-Setup\vcpkg\buildtrees\openssl\x64-windows-static-rel\providers\implementations\ciphers\cipher_aes_cfb_hw_aesni.inc
- C:\Users\Marko\Documents\Roblox\Scripts\GitHub-Repos\Real-Executor\Real-Setup\vcpkg\buildtrees\openssl\x64-windows-static-rel\crypto\ml_dsa\ml_dsa_vector.h
- l:\;
More Smuggling samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report