MALICIOUS — c74daacd99d7d11060027d5437e9b4ddab40a49d7bf58b63557bc30785d38eea

MALICIOUS — c74daacd99d7d11060027d5437e9b4ddab40a49d7bf58b63557bc30785d38eea is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the ToxicEye family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: c74daacd99d7d11060027d5437e9b4ddab40a49d7bf58b63557bc30785d38eea
SHA-1: 1e712ce0f6f03ad5522ffa7079db2ccdda12efd4
MD5: cd506b970fc4f2be7ba7dfd2c490a838
imphash: 4328f7206db519cd4e82283211d98e83
ssdeep: 98304:cFQoWJcYi33S/gLOY9yis1RJ1ldCGLjjpfaVNsIdR:cFQogniHSoLFofJ1vCGLj5aVXdR
TLSH: T1385F33C0164A1385D7DAFD863D94980DFB35E1F6E68C9BCBC0469238AF73703585298A
Submitted as: c74daacd99d7d11060027d5437e9b4ddab40a49d7bf58b63557bc30785d38eea
File type: pe · Size: 3200072 bytes
Verdict: malicious (99/100) · Family: ToxicEye

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
Detect It Easy (packer/type): DIE:Themida/Winlicense
Microsoft Defender: Trojan:Win32/Wacatac.B!ml
Emsisoft (Emergency Kit): Trojan.Generic.36642920
Kaspersky (KVRT): UDS:Trojan-Banker.MSIL.ClipBanker.ame

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 12 weighted signals:

Microsoft Defender flagged Trojan:Win32/Wacatac.B!ml (rule Trojan:Win32/Wacatac.B!ml) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Generic.36642920 (rule Trojan.Generic.36642920) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan-Banker.MSIL.ClipBanker.ame (rule UDS:Trojan-Banker.MSIL.ClipBanker.ame) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Scheduled Task / Job [medium] (rule tl-scheduled-task) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497.001, T1497 - dynamic signal, weight 0.40, confidence 0.75
Extracted ToxicEye config (0 C2) - engine signal, weight 0.45, confidence 0.60
Detect It Easy (packer/type) flagged DIE:Themida/Winlicense (rule DIE:Themida/Winlicense) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Themida/VMProtect (rule Themida/VMProtect) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Themida/VMProtect, high-entropy-sections: , ,.boot, Themida/Winlicense - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

16456 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

c9755626dc83b13f603a7add12ae1e9e3970354b44c707f4ffab459f19ef7315 - c9755626dc83b13f603a7add12ae1e9e3970354b44c707f4ffab459f19ef7315
65c86bf264706fe62296afce52fa3a42b41a05d1086cfb4561c5f28381fc60d9 - 65c86bf264706fe62296afce52fa3a42b41a05d1086cfb4561c5f28381fc60d9
85868f6cdeb4af6dc92e275ca233ce5a6c2b8adfc67705771012f9df84dec293 - 85868f6cdeb4af6dc92e275ca233ce5a6c2b8adfc67705771012f9df84dec293

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

w.cn
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

40.79.150.121
4.230.171.124
20.247.184.142
74.178.240.51
40.84.85.40
4.150.223.102
135.232.92.137
172.66.2.5
4.150.223.101
48.192.143.121
4.150.223.100
34.104.35.123
135.233.45.221
52.178.17.234
203.26.79.13
125.56.205.25
125.56.205.123
52.110.12.51
20.42.179.204
52.148.114.188
72.154.7.107
92.223.78.30
52.110.12.31
52.110.12.47

File paths

R:\zO

More ToxicEye samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report