MALICIOUS — bf24b9038d62e583777904382865320cc5d63f180a9df4aa825f1b401e09d7fb

MALICIOUS — bf24b9038d62e583777904382865320cc5d63f180a9df4aa825f1b401e09d7fb is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Glupteba family. 5 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: bf24b9038d62e583777904382865320cc5d63f180a9df4aa825f1b401e09d7fb
SHA-1: 90e3ceab4531b4c75331bd5c007ffc15cc65eea0
MD5: 0c0355d022566a7b598e375d23a2166f
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 1536:TbGgvh2ZEEn7HUh8MIOaPaNS3vq12MvKZ4qJ4w1mk8OaeFIzDoldSriwM:T12T0h8MIOO7e27HJmzcKaSriT
TLSH: T10739F1238E97DA5CC3FF220A4C99560CE0C7D211A45DCAA382A7A7904DF48B3357756A
Submitted as: bf24b9038d62e583777904382865320cc5d63f180a9df4aa825f1b401e09d7fb
File type: pe · Size: 86528 bytes
Verdict: malicious (99/100) · Family: Glupteba

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Gen:Variant.Razy.870640
Trellix Stinger (McAfee): Glupteba-FUBP!0C0355D02256
Kaspersky (KVRT): HEUR:Trojan.Win32.Copak.pef

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

Memory forensics: 2 finding(s) attributed to the sample across 2 technique(s), e.g. process hollowing in tsk_a79f320df4 (pid 1412) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.75, confidence 0.85
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Razy.870640 (rule Gen:Variant.Razy.870640) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Glupteba-FUBP!0C0355D02256 (rule Glupteba-FUBP!0C0355D02256) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Copak.pef (rule HEUR:Trojan.Win32.Copak.pef) - engine signal, weight 0.55, confidence 0.85
Contacted 2 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

112 behavior events · 0 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\tsk_a79f320df4014416.exe - 58222667a31cfb00884ba5b0201cc5488630c5dd72c1fb0cbf2f5dae363e0d75
c34eeb1cfafafd947460909b9eb5f2ec6d79a2155d7a462bd564b03a23399099 - c34eeb1cfafafd947460909b9eb5f2ec6d79a2155d7a462bd564b03a23399099
8a971e85f17e7521d91fdd5e200ab99a1bc98d01db2291f60cf59dca9e9b8a07 - 8a971e85f17e7521d91fdd5e200ab99a1bc98d01db2291f60cf59dca9e9b8a07
0642778f7ab8064902e3a9a19c18ae5a564ef8d77f77932ebb496563e79cf8f7 - 0642778f7ab8064902e3a9a19c18ae5a564ef8d77f77932ebb496563e79cf8f7
6577bced8e6b4a8c1b39f877a6ec08a1f4773a79ef02fbed78b32e00db406897 - 6577bced8e6b4a8c1b39f877a6ec08a1f4773a79ef02fbed78b32e00db406897

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

13.69.116.105
4.144.132.114
4.230.171.124
52.110.12.37
52.110.12.8
85.210.196.11
52.110.12.3
52.110.12.28
52.148.114.188
72.153.5.60

More Glupteba samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report