MALICIOUS — c73d06fdd1ff143df90d69eb517e47264c6372da03f989788e7446bd7ee0ef02

MALICIOUS — c73d06fdd1ff143df90d69eb517e47264c6372da03f989788e7446bd7ee0ef02 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Infostealer family. 4 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: c73d06fdd1ff143df90d69eb517e47264c6372da03f989788e7446bd7ee0ef02
SHA-1: 1dab7f0e7f9e4ffe78f2da9a3b01576658dc9978
MD5: ffe6f5862793e2563e8b6aece23ae97e
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 192:8BksuzPY82gQv5F4MtjeMZZ3M93VnjdwCz+37o6ey:882l4MtjeM4FnhwCK86e
TLSH: T13222FAEE1E588B97CB7EDA175145C97E6490788F29F3228C020447321578827E87F79B
Submitted as: c73d06fdd1ff143df90d69eb517e47264c6372da03f989788e7446bd7ee0ef02
File type: pe · Size: 9728 bytes
Verdict: malicious (99/100) · Family: Infostealer

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Msilkrypt-9839010-0
Microsoft Defender: PWS:MSIL/Infostealer.PAC!MTB
Emsisoft (Emergency Kit): Gen:Variant.Jalapeno.330
Kaspersky (KVRT): HEUR:Trojan.MSIL.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Msilkrypt-9839010-0 (rule Win.Malware.Msilkrypt-9839010-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
Extracted RedLine config (0 C2) - engine signal, weight 0.45, confidence 0.60
Embedded network infrastructure: http://tempuri.org/IUserService/GetUsersT, http://194.87.145.184:6484/UserService, 194.87.145.184 - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

3953 behavior events · 2 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://tempuri.org/IUserService/GetUsersT
http://194.87.145.184:6484/UserService
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787802046&P2=404&P3=2&P4=ai97Uw4r4q8UjuKeCH4dwT5m%2bXGxkfDb7ksurakmAznR5ndMrsByGH%2bcX5dajhgQWgNlp8JfEeCP6ZgUmXKeGw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.datacontract.org
tempuri.org

Embedded IP addresses

194.87.145.184
20.42.65.93
52.123.252.227
52.123.252.220
40.84.85.40
4.230.171.124
52.230.59.222
52.123.252.232
20.165.94.46
135.233.95.144
4.150.223.110
74.179.77.164
203.26.79.13
20.231.239.246
52.123.128.14
13.69.116.104
172.178.240.161
135.234.160.246
52.110.12.53
52.148.114.188
72.145.35.101
52.110.12.38

More Infostealer samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report