MALICIOUS — bcad04becb69da7306d218ce725ccb1c4a50b2ce51eb8ca291bd9e105565e1ae

MALICIOUS — bcad04becb69da7306d218ce725ccb1c4a50b2ce51eb8ca291bd9e105565e1ae is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Astaroth family. 4 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: bcad04becb69da7306d218ce725ccb1c4a50b2ce51eb8ca291bd9e105565e1ae
SHA-1: bc63bd188e372ad4d3b92331452cf577378bf914
MD5: 21b972180436cc0ed67826164c1c2567
imphash: d0b8285184365a838ba34f4f2ef57766
ssdeep: 48:iqn+x7OyhnWmNwVaCzT6z4yRdBHAGmTAnn+YsC9A1lRm/WRLYY0jvUzki8A:ipTlbCzO4aVSTmrqmuRLYYSvUzkE
TLSH: T12922F0CE80E82A56CB7655B61632C94E9256B0F204BD790D5E4EC23C51C39A3FE21D22
Submitted as: bcad04becb69da7306d218ce725ccb1c4a50b2ce51eb8ca291bd9e105565e1ae
File type: pe · Size: 9828 bytes
Verdict: malicious (99/100) · Family: Astaroth

Detections (4 of 55 engines)

ClamAV (daily): Win.Downloader.Tiny-9940499-0
Microsoft Defender: Trojan:Win32/Astaroth.psyW!MTB
Emsisoft (Emergency Kit): Gen:Variant.Zbot.1134
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Downloader.Tiny-9940499-0 (rule Win.Downloader.Tiny-9940499-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

11430 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\fcbnaf.exe - 78211e445230455945ee7939782050d6425c461ff4469a0658c3d4796c1bb3b7

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

huyontop.com

Embedded IP addresses

20.184.175.11
52.123.252.244
4.230.171.124
52.253.84.76
48.211.4.16
74.178.76.128
4.150.223.101
74.179.77.164
20.165.94.63
20.76.201.171
52.123.128.14
40.99.134.2
52.123.129.14
135.233.45.223
52.123.252.248
92.223.78.30
172.178.240.163
52.110.12.5
52.110.12.50
52.148.114.188
52.123.252.197
135.232.92.34
52.168.117.169
52.178.17.2
72.153.5.96

File paths

Z:\Projects\Loader\Release\Loader.pdb
C:\Users\admin\Downloads\fcbnaf.exe
C:\3cabf321df1512aa0674c8f3a7a022174209c742fde3914adf6325e9497fb94b
C:\sample.exe
C:\Users\george\Desktop\file000_fcbnaf.exe
C:\c84e79c2373317470929ca50a94eb50a4071a7388b534965d7288ab3baa69e7b
C:\Users\george\Desktop\fcbnaf.exe
C:\f1f1e1470b8c61e8a4e1efe39d1008b434d524d9700d2aee718f814862c09fe1
C:\e4e4f247ff4a5921731f34ad4b3abfa1ec0d77bdd9c979bd39d16963a932626d
C:\Users\admin\Downloads\e8dfbd1d5e208094deae6e2af45377e18f095f6680131d58016d6be920b6da96.exe
C:\4d5e681505f494134079352e26403b9e0299045288f7317461884047391fead0

More Astaroth samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report