MALICIOUS — c50cbe6d14ffca8be306c198240463148bcfa1800c7f6068c862b43e139ba938

MALICIOUS — c50cbe6d14ffca8be306c198240463148bcfa1800c7f6068c862b43e139ba938 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (86/100). 3 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: c50cbe6d14ffca8be306c198240463148bcfa1800c7f6068c862b43e139ba938
SHA-1: a81a159884950bf703c7cf8e7f94e0afe85a952c
MD5: 936b5f640910479299eae33c70b8ffa3
imphash: a85130a8b5cf614624d22afc28d91389
ssdeep: 196608:+Zx7QICteEroXx+VfEqlbkkwR7VTEJZF41Q7Si1G0L:8QInEroXgfEqirRRoJZ6m7DN
TLSH: T15F67331E065776E1DDF2EC6098C4ACCD8933F3888576F8595A46DC8D34E0833A1F2A89
Submitted as: c50cbe6d14ffca8be306c198240463148bcfa1800c7f6068c862b43e139ba938
File type: pe · Size: 6942280 bytes
Verdict: malicious (86/100)

Detections (3 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
Detect It Easy (packer/type): DIE:Microsoft Linker
Kaspersky (KVRT): HEUR:Trojan-PSW.Multi.Disco.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 86/100 is the fusion of 5 weighted signals:

Dropped a malicious payload: libcrypto-1_1.dll - dynamic signal, weight 0.62, confidence 0.90
Contacted 22 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

4367 behavior events · 0 ATT&CK techniques · 21 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\_MEI85802\_queue.pyd - b0bd6330c525b4c64d036d29a3733582928e089d99909500e8564ae139459c5f
C:\Users\analyst\AppData\Local\Temp\_MEI85802\select.pyd - 5361da714a61f99136737630d50fa4e975d76f5de75e181af73c5a23a2b49012
C:\Users\analyst\AppData\Local\Temp\_MEI85802\libcrypto-1_1.dll - 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
C:\Users\analyst\AppData\Local\Temp\_MEI85802\_hashlib.pyd - 7936413bc24307f01b90cac2d2cc19f38264d396c1ab8eda180abba2f77162eb
C:\Users\analyst\AppData\Local\Temp\_MEI85802\base_library.zip - 7ae17d6eb5d9609dc8fc67088ab915097b4de375e286998166f931da5394d466
C:\Users\analyst\AppData\Local\Temp\_MEI85802\pyexpat.pyd - ab0814b19fd6b10d2729a907cf449f8a858a42b3f1288fb1c93b62950059295d
C:\Users\analyst\AppData\Local\Temp\_MEI85802\_ctypes.pyd - 1548506345d220d68e9089b9a68b42a9d796141eb6236e600283951cb206eaa1
C:\Users\analyst\AppData\Local\Temp\_MEI85802\libssl-1_1.dll - b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
C:\Users\analyst\AppData\Local\Temp\_MEI85802\_bz2.pyd - 9483c4853ca1da3c5b2310dbdd3b835a44df6066620278aa96b2e665c4b4e86b
C:\Users\analyst\AppData\Local\Temp\_MEI85802\_socket.pyd - 241db349093604ab25405402ba8c4212016657c7e6a10edd3110abeb1cc2e1ba
C:\Users\analyst\AppData\Local\Temp\_MEI85802\nitrogratis.exe.manifest - 9c0614acf5ed1d33fd12b18911839245210144bd958edabef0d487fe48e0e7c8
C:\Users\analyst\AppData\Local\Temp\_MEI85802\_multiprocessing.pyd - a55c37779772a36bfb5811cc349dcdc2429ef1fbab40fe4cfea9d7fcd23173ab
C:\Users\analyst\AppData\Local\Temp\_MEI85802\_overlapped.pyd - fd9e9467e1353f9dc02143481085f2440f25286d0a4630aa8b1d8919cbb50b8f
C:\Users\analyst\AppData\Local\Temp\_MEI85802\python39.dll - e456ef44b261f895a01efb52d26c7a0c7d7d465b647a7b5592708ebf693f12a3
C:\Users\analyst\AppData\Local\Temp\_MEI85802\_lzma.pyd - 4797aaf192eb56b32ca4febd1fad5be9e01a24e42bf6af2d04fcdf74c8d36fa5

Embedded URLs

http://schemas.microsoft.com/SMI/2016/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787932918&P2=404&P3=2&P4=AP%2fpE0oegL0Zt6PygbLUaUtHtVIpXVGIBeex9FskNimFaHP%2bEAll1mFOpRG59k7pr7b%2bnoY2%2bnBNMdPxsTsQsA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
a.ru
api.ipify.org
discord.com

Embedded IP addresses

20.42.65.84
52.123.252.198
4.247.188.233
4.230.171.124
4.144.132.223
135.232.92.137
52.168.117.168
74.178.240.51
20.76.201.171
52.123.128.14
52.123.129.14
172.178.240.162
104.26.12.205
162.159.135.232
52.110.12.3
52.110.12.14
203.26.79.13
72.154.7.111
52.148.114.188
52.110.12.15
135.232.92.34
52.110.12.38

File paths

T:\I)&4%
N:\q
y:\,u

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report