MALICIOUS — c7ae876f761df48edda147cd74863e61a3b2108bc29477f0d3b41bd9a5feaac0

MALICIOUS — c7ae876f761df48edda147cd74863e61a3b2108bc29477f0d3b41bd9a5feaac0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the ASPack family. 7 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: c7ae876f761df48edda147cd74863e61a3b2108bc29477f0d3b41bd9a5feaac0
SHA-1: 274b314d197c4028993836cd0d69a3e0180c74dc
MD5: eaab5dd7a6defcbb76c2ec6460bb99e8
imphash: c500f341b19340dabf5e4ee5558549b1
ssdeep: 1536:1BucKHs7K2HEG7BpoWiZBYHs977q+7INVdU2Aneb61TVcz+3MJb6rcr:PuchogM57bIL+eb61TVa+3MJb6u
TLSH: T1DE424A8CC5F567C9EBE387202E544E1E68E16CDCD0BE4C181A87D02D67D2A27E6D118B
Submitted as: c7ae876f761df48edda147cd74863e61a3b2108bc29477f0d3b41bd9a5feaac0
File type: pe · Size: 214123 bytes
Verdict: malicious (100/100) · Family: ASPack

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Visual C/C++
ClamAV (daily): Win.Dropper.Tinba-9943147-2
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:Microsoft Visual C/C++
Microsoft Defender: Trojan:Win32/SystemBC!pz
Emsisoft (Emergency Kit): Trojan.GenericKD.47310135
Kaspersky (KVRT): Backdoor.Win32.Plite.bhtm

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Dropper.Tinba-9943147-2 (rule Win.Dropper.Tinba-9943147-2) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/SystemBC!pz (rule Trojan:Win32/SystemBC!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKD.47310135 (rule Trojan.GenericKD.47310135) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Plite.bhtm (rule Backdoor.Win32.Plite.bhtm) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Visual C/C++ (rule DIE:Microsoft Visual C/C++) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Microsoft Visual C/C++ (rule Microsoft Visual C/C++) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
Embedded network infrastructure: 112.175.88.208, 112.175.88.209, 218.54.31.226 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: Microsoft Visual C/C++ - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

13136 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\huter.exe - 3a1c939e3b66af4221940e3309f8e261cb34784f6cab74189216d4c0a2dc9250
C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - 77fcdadc9ba56daa81edb3f0ef876e38a8c7de56187c28c7d02992cd9e0a243d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

112.175.88.208
112.175.88.209
218.54.31.226
112.175.88.207
20.52.64.201
4.230.171.124
4.144.132.114
40.84.97.4
172.64.154.167
20.165.94.54
4.150.223.96
135.233.95.144
4.150.223.102
74.179.77.204
162.159.142.9
4.150.223.104
20.42.73.28
57.155.101.212
172.178.240.162
92.223.78.30
72.154.7.110
52.148.114.188
52.110.12.42
52.110.12.48

More ASPack samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report