MALICIOUS — c2b861ee1d4c8f4e4caa8dfd23b37bfea1cc7e371e0f158c23e6c244bfd36ae5

MALICIOUS — c2b861ee1d4c8f4e4caa8dfd23b37bfea1cc7e371e0f158c23e6c244bfd36ae5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Crypted family. 5 of 56 detection engines flagged it.

Identification

• SHA-256: c2b861ee1d4c8f4e4caa8dfd23b37bfea1cc7e371e0f158c23e6c244bfd36ae5
• SHA-1: e86a9a88afa88cf02d97ba0f12875cb4d3711cf3
• MD5: ba8f6cafa4fa9648477a4a38a8e8c03d
• imphash: c2a87fabf96470db507b2e6b43bd92eb
• ssdeep: 3072:qiOt3M3a7qx+cuzQOAYSgO8p8odhlzym6TgvYB0:wtASqYzQONSF8pP5ow60
• TLSH: T1D33C186EC6100F46CCB6E3458655BB8D91BD0054E47E86FA540AACCBFF0AC97B81936C
• Submitted as: c2b861ee1d4c8f4e4caa8dfd23b37bfea1cc7e371e0f158c23e6c244bfd36ae5
• File type: pe · Size: 114688 bytes
• Verdict: malicious (99/100) · Family: Crypted

Detections (5 of 56 engines)

• ClamAV (daily): Win.Trojan.Crypted-30
• Microsoft Defender: Backdoor:Win32/Berbew!pz
• Emsisoft (Emergency Kit): GenPack:Generic.Dacic.1.Backdoor.Hangup.A.8D3133A2
• Trellix Stinger (McAfee): Trojan-FUGH!BA8F6CAFA4FA
• Kaspersky (KVRT): Trojan-Proxy.Win32.Qukart.vjh

Why this verdict

The malicious score of 99/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Crypted-30 (rule Win.Trojan.Crypted-30) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Backdoor:Win32/Berbew!pz (rule Backdoor:Win32/Berbew!pz) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged GenPack:Generic.Dacic.1.Backdoor.Hangup.A.8D3133A2 (rule GenPack:Generic.Dacic.1.Backdoor.Hangup.A.8D3133A2) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Trojan-FUGH!BA8F6CAFA4FA (rule Trojan-FUGH!BA8F6CAFA4FA) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Trojan-Proxy.Win32.Qukart.vjh (rule Trojan-Proxy.Win32.Qukart.vjh) - engine signal, weight 0.55, confidence 0.85

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

More Crypted samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report