MALICIOUS — bb46595c5c070ac0dbcb31f9b563dd37cf4c32f736c7bb8b45356e43fe1d30dd

MALICIOUS — bb46595c5c070ac0dbcb31f9b563dd37cf4c32f736c7bb8b45356e43fe1d30dd is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Brontok family. 6 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: bb46595c5c070ac0dbcb31f9b563dd37cf4c32f736c7bb8b45356e43fe1d30dd
• SHA-1: 5a11273b4076555df01f6c6b19231d9296c266eb
• MD5: e12562844dcd975d97aa910fa9ea60b5
• imphash: c81d603829cdee893f69bc47cb4f6e00
• ssdeep: 1536:5v3MoORizUPliPsm/gL16ZpQGh6MgHN+PhuLGR/11OrtpvHMoON:R3xOMUMPsgQvTMY+PhGGR/11OrnHxON
• TLSH: T1223A4B2850B5F706E7C6DC27A7358A4E90416478E2F46ECA25C2C20F71F1F635C865EA
• Submitted as: bb46595c5c070ac0dbcb31f9b563dd37cf4c32f736c7bb8b45356e43fe1d30dd
• File type: pe · Size: 99999 bytes
• Verdict: malicious (99/100) · Family: Brontok

Detections (6 of 52 engines)

• capa (capabilities): capability:credential-access
• ClamAV (daily): Win.Worm.Brontok-9815928-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Worm:Win32/Brontok.BJ@mm
• Emsisoft (Emergency Kit): Win32.Worm.Brontok.AM
• Kaspersky (KVRT): Email-Worm.Win32.Brontok.o

MITRE ATT&CK

• T1555
• T1003
• T1547.001
• T1071.001

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

• ClamAV (daily) flagged Win.Worm.Brontok-9815928-0 (rule Win.Worm.Brontok-9815928-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Worm:Win32/Brontok.BJ@mm (rule Worm:Win32/Brontok.BJ@mm) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Win32.Worm.Brontok.AM (rule Win32.Worm.Brontok.AM) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Email-Worm.Win32.Brontok.o (rule Email-Worm.Win32.Brontok.o) - engine signal, weight 0.55, confidence 0.85
• access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded domains

• services.com
• yesbron.com
• 15-bali.com
• k.com

File paths

• C:\Baca

More Brontok samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report