MALICIOUS — be7e3c36fca4471b666493679a18e296250cabf4fe8a38cb73cbca526b44e05e

MALICIOUS — be7e3c36fca4471b666493679a18e296250cabf4fe8a38cb73cbca526b44e05e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the MSILHeracles family. 4 of 56 detection engines flagged it.

Identification

• SHA-256: be7e3c36fca4471b666493679a18e296250cabf4fe8a38cb73cbca526b44e05e
• SHA-1: e5cfa0e2cd272894d705ded8c014fd2b039d4ac2
• MD5: 48b65c7a1c8b40f450265d30dea5f44c
• imphash: d41d8cd98f00b204e9800998ecf8427e
• ssdeep: 96:az6Vz4C8AG+pz01htd1lvAooYSaFfCiQnHSPt0gfNXhsr2nnh+F8LnHLJMLzLIz:az6Vz+1htzIgaFnHO2gVhs5ezFMHW
• TLSH: T15C2109CE121CA740C766CC373EA288AE41A1B5A9D1B4111C4F494B3256AF23BDC772F9
• Submitted as: be7e3c36fca4471b666493679a18e296250cabf4fe8a38cb73cbca526b44e05e
• File type: pe · Size: 8704 bytes
• Verdict: malicious (99/100) · Family: MSILHeracles

Detections (4 of 56 engines)

• ClamAV (daily): Win.Packed.Bulz-9957811-0
• Microsoft Defender: Trojan:MSIL/Rozena.KAE!MTB
• Emsisoft (Emergency Kit): Gen:Variant.MSILHeracles.125159
• Kaspersky (KVRT): HEUR:Trojan.MSIL.Agent.gen

Why this verdict

The malicious score of 99/100 is the fusion of 6 weighted signals:

• ClamAV (daily) flagged Win.Packed.Bulz-9957811-0 (rule Win.Packed.Bulz-9957811-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:MSIL/Rozena.KAE!MTB (rule Trojan:MSIL/Rozena.KAE!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.MSILHeracles.125159 (rule Gen:Variant.MSILHeracles.125159) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.MSIL.Agent.gen (rule HEUR:Trojan.MSIL.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• Contacted 1 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

517 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• assets.msn.com
• licensing.mp.microsoft.com
• www.bing.com
• aefd.nelreports.net
• fe3cr.delivery.mp.microsoft.com
• th.bing.com
• settings-win.data.microsoft.com

Dropped files

• be2ac694c3c74af7ab805026b07ec37808a6e9a5926a6beef8a005ee5fe26f5c - be2ac694c3c74af7ab805026b07ec37808a6e9a5926a6beef8a005ee5fe26f5c

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• aefd.nelreports.net

Embedded IP addresses

• 10.0.133.23
• 20.42.73.25
• 4.230.171.124
• 52.110.12.20
• 52.110.12.51
• 52.253.84.76
• 20.165.94.54
• 48.211.4.16
• 4.150.223.103
• 74.179.77.204
• 104.18.33.89
• 172.66.2.5
• 20.42.179.204
• 4.150.223.100
• 72.154.7.108
• 52.148.114.188
• 52.110.12.26

File paths

• c:\windows\system32\svchost.exe

More MSILHeracles samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report