MALICIOUS — b69ae43594c9d5794feb65fb512dc15dfda54e77425885ad0cbd102aa28cf3d8

MALICIOUS — b69ae43594c9d5794feb65fb512dc15dfda54e77425885ad0cbd102aa28cf3d8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the VBChinky family. 4 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: b69ae43594c9d5794feb65fb512dc15dfda54e77425885ad0cbd102aa28cf3d8
SHA-1: 67aa61b45dc9564ee04a09f36c8d01c3c3dccf53
MD5: ca6fae0d8e9a4b4ccfe719b6e0b73a0d
imphash: ee76f05021d9ab4709f51fe3581a8f88
ssdeep: 768:x/Lp7oiqziBnhc8eMq87wT2ji/6/wURHojuJraAFvyZfsp4J:x/5nQLZ2j2ewURHoRAFqsOJ
TLSH: T1BB389AD4070A7D04E1A7682F8A76071D1ACFCF7A933F509402086ADCF59AFAB49D598C
Submitted as: b69ae43594c9d5794feb65fb512dc15dfda54e77425885ad0cbd102aa28cf3d8
File type: pe · Size: 81920 bytes
Verdict: malicious (100/100) · Family: VBChinky

Detections (4 of 56 engines)

ClamAV (daily): Html.Trojan.VBChinky-1
Microsoft Defender: Worm:Win32/Vobfus.AC
Emsisoft (Emergency Kit): Gen:Trojan.Chinky.2
Kaspersky (KVRT): Trojan.Win32.Vobfus.qvc

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Html.Trojan.VBChinky-1 (rule Html.Trojan.VBChinky-1) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Worm:Win32/Vobfus.AC (rule Worm:Win32/Vobfus.AC) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Trojan.Chinky.2 (rule Gen:Trojan.Chinky.2) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Vobfus.qvc (rule Trojan.Win32.Vobfus.qvc) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

35355 behavior events · 2 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\~DFA2BFE3EC142C802D.TMP - 50d6ac29bc8418dcf474f72673ebb1d9b9741885835ea572af8fd3ce70ea0c32
C:\Users\analyst\quobuu.exe - 4f1c9ab456f208b746560b3308c0eae719552fc434e59212a1f1c666d0eee7f7
34af3c52919257c9d15b213d82f87d4601d9a363ec20e34f4f950963d526f31a - 34af3c52919257c9d15b213d82f87d4601d9a363ec20e34f4f950963d526f31a
fcf48f9f4d8a49855181e7a3c6cf09271b025bb66eff6a1cce1e5d6ad9e56747 - fcf48f9f4d8a49855181e7a3c6cf09271b025bb66eff6a1cce1e5d6ad9e56747
d0b666b5126355c0cc3cbf28666200b963f45a61df2bfe18f07ee3be23e3b374 - d0b666b5126355c0cc3cbf28666200b963f45a61df2bfe18f07ee3be23e3b374

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

ns2.thepicturehut.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

51.116.246.105
52.123.252.204
4.230.171.124
57.155.101.212
4.144.132.114
20.165.94.63
74.178.240.51
20.42.73.31
20.184.175.11
4.247.188.233
135.234.160.244
172.215.188.232
52.110.12.47
52.182.143.212
72.154.7.96
52.148.114.188
52.110.12.38
52.110.12.42

More VBChinky samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report