MALICIOUS — bae6157ecc8725f45770344bd174e6eef095660d3b89e042130bb154909e95ad

MALICIOUS — bae6157ecc8725f45770344bd174e6eef095660d3b89e042130bb154909e95ad is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Triusor family. 7 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: bae6157ecc8725f45770344bd174e6eef095660d3b89e042130bb154909e95ad
SHA-1: 39dc22236521a518e43dbbf876b5ac7020f06979
MD5: 03f61ab05091eeaf4b833d9ff6b7ad38
imphash: 8b1fc5c989964e6fc1675250748f63dc
ssdeep: 49152:dzvKfNuIhakf8V8ySK+JLoUvgsOyCPO4OyCPO9I8boQhfD6UDvxvykXk1rBsgye:dzMcOe8hK+JLwbPO3POfDm
TLSH: T19F6606CB563B71B1C5B6991CAD60A4BDA016BC64C1393B5C14CAF2E5CCF0A3BAD38065
Submitted as: bae6157ecc8725f45770344bd174e6eef095660d3b89e042130bb154909e95ad
File type: pe · Size: 6579793 bytes
Verdict: malicious (100/100) · Family: Triusor

Detections (7 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
capa (capabilities): capability:credential-access
ClamAV (daily): Win.Virus.Triusor-6887833-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
YARA: Yara-Rules community: YR_AntiDebug_Checks
Kaspersky (KVRT): HEUR:Trojan.Win32.Agentb.gen

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Virus.Triusor-6887833-0 (rule Win.Virus.Triusor-6887833-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Agentb.gen (rule HEUR:Trojan.Win32.Agentb.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:credential-access (rule capability:credential-access) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.30, confidence 0.70
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://go.microsoft.com/fwlink/?LinkId=131738
http://www.microsoft.com/pki/certs/CSPCA.crt0
http://www.microsoft.com/pki/certs/tspca.crt0
http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

go.microsoft.com
crl.microsoft.com
www.microsoft.com
schemas.microsoft.com

Embedded IP addresses

51.132.193.104
52.123.252.224
172.215.188.232
4.230.171.124
52.230.59.222
135.232.92.97
51.105.71.136
74.178.76.128
172.64.154.167
162.159.142.9
125.56.205.24
92.223.78.30
125.56.205.26
52.110.12.26
74.179.77.204
52.110.12.40

File paths

f:\dd\Tools\devdiv\finalpublickey.snk
f:\dd\tools\devdiv\EcmaPublicKey.snk
f:\RedBits\Tools\devdiv\FinalPublicKey.snk

More Triusor samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report