MALICIOUS — 088_EarthKrahang_20240404.bin

MALICIOUS — 088_EarthKrahang_20240404.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Malgent family. 4 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: b8f2da1eefa09077d86a443ad688080b98672f171918c06e2b3652df783be03a
• SHA-1: 9f5530d3d6be5b3ae3e04275ba955ec7cdf5255e
• MD5: 0f6e0ff20e797b2a6153510a9b0275fd
• imphash: f34d5f2d4577ed6d9ceec516c1f5a744
• ssdeep: 1536:QzFjvY5dTjfNwT2FUxur6MfTVCvzXIDbWLvm8a:ajvAnNu2SEr6MMzC0I
• TLSH: T1F843A29983122638CDFCAF0C5F8A135D72CEA335786EC844ED1261582A676B35E3349D
• Submitted as: 088_EarthKrahang_20240404.bin
• File type: pe · Size: 228864 bytes
• Verdict: malicious (98/100) · Family: Malgent

Detections (4 of 51 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
• ClamAV (daily): {MD5}bin.trojan.reshell.9244.UNOFFICIAL
• Microsoft Defender: Trojan:Win32/Malgent!MSR
• Emsisoft (Emergency Kit): Gen:Variant.Generic.524

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 98/100 is the fusion of 6 weighted signals:

• ClamAV (daily) flagged {MD5}bin.trojan.reshell.9244.UNOFFICIAL (rule {MD5}bin.trojan.reshell.9244.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Memory forensics: 6 finding(s), e.g. RWX/private injected region in sppsvc.exe (pid 7344) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Microsoft Defender flagged Trojan:Win32/Malgent!MSR (rule Trojan:Win32/Malgent!MSR) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Generic.524 (rule Gen:Variant.Generic.524) - engine signal, weight 0.55, confidence 0.85
• Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

838 behavior events · 1 ATT&CK techniques · 1 dropped files.

Runtime network

• none

Dropped files

• 804387e43fdd1bd45b35e65d52d86882d64956b0a286e8721da402062f95a9e3 - 804387e43fdd1bd45b35e65d52d86882d64956b0a286e8721da402062f95a9e3

More Malgent samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report