MALICIOUS — c8161b4bed1a0d139c04b34954478fefc68350d8f6e5d8d47845fd8917bd42dc

MALICIOUS — c8161b4bed1a0d139c04b34954478fefc68350d8f6e5d8d47845fd8917bd42dc is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Padodor family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: c8161b4bed1a0d139c04b34954478fefc68350d8f6e5d8d47845fd8917bd42dc
SHA-1: cd4159b6016bc6bf8bb2e91616f919521e3f2fbc
MD5: c58c9c8ddbe17c89e535896de40367b4
imphash: 26babd76bbb7f9c516a338b0601b4c9f
ssdeep: 1536:aolQ6HvKLJGx1Bnuwf002KK3Nb068HWWvyN6Xo8Gj7ox:aolQiKLJGxJ0/eU98Gj7I
TLSH: T154386CDA83198C4FCEC5335F8299705E9D82B778D91762CB8482967F2ED010F8B16275
Submitted as: c8161b4bed1a0d139c04b34954478fefc68350d8f6e5d8d47845fd8917bd42dc
File type: pe · Size: 77824 bytes
Verdict: malicious (99/100) · Family: Padodor

Detections (4 of 56 engines)

ClamAV (daily): Win.Trojan.Crypted-30
Microsoft Defender: Backdoor:Win32/Padodor.SK!MTB
Emsisoft (Emergency Kit): Trojan.Peed.Gen
Kaspersky (KVRT): Backdoor.Win32.Padodor.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Trojan.Crypted-30 (rule Win.Trojan.Crypted-30) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Backdoor:Win32/Padodor.SK!MTB (rule Backdoor:Win32/Padodor.SK!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Peed.Gen (rule Trojan.Peed.Gen) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Padodor.gen (rule Backdoor.Win32.Padodor.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Dropped 114 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

3593 behavior events · 1 ATT&CK techniques · 114 dropped files.

Dropped files

C:\Windows\System32\Kppoem32.dll - b5a7fdbb61714745ba394be43a9ce2b7421e461482a47f633f2bb34ee8d53e23
C:\Windows\System32\Mcqfajmm.exe - 33fad318231f8c4f34fdda1c5c46179218bea4132e4847ac3074e4112e0869ac
C:\Windows\System32\Jfpfkccg.exe - 7798d71f790706e4915d4dcd79efdbafc791c63d25e4db376f3469d1b4496a23
C:\Windows\System32\Jfjhehea.dll - caad7bef77ab5d8166f00911ad5abd974b98e83696149a79f1892a8ae48d06f4
C:\Windows\System32\Kohfamlf.exe - 65ed0a9f7b7f6e32053b81a262635c1498dfc458e4c764bf2f663f86eeeadb35
C:\Windows\System32\Gblofmdn.exe - cd760d3d31fcfa3abd264ce16bef93859bb607f6695b77d4a587f134b1095797
C:\Windows\System32\Acglnb32.dll - c5e756c60d11c638cede23d6b4ccfeff15d99d806e3b8cc3d03fd43b730e984d
C:\Windows\System32\Bqdagbnl.exe - ad88659d837cf315ff32657875e882b15cb3b8f774dd75388ab0d35e14b0504b
C:\Windows\System32\Efhijdof.exe - a9f3e7c222458227ded75951ab7a847a3ce3f9b60cec672d977fb65a234974ee
C:\Windows\System32\Kbpjfc32.exe - ac3b38053409cf6a82e5f4aad3bd463a1bc1c5169d0d0eef80e3b4bae6b62e5c
C:\Windows\System32\Mijcke32.dll - a19ebbc2941a522d22af588628fb103528d2a848a582e537c0f01dd376881696
C:\Windows\System32\Klohcmfo.exe - 0f260a818527f386c70a8a47451cfc1f20e0984e76bd35fe4d3a084de06e4a4c
C:\Windows\System32\Mappgi32.exe - cafa56f9fd67150c21924d16a59788c76be11b7d07a8adbf4653fd5048e16d77
C:\Windows\System32\Gjmnkpgd.dll - 1d91d630392c4c521e142971de9a54ca62bea03592543c66c3ff482f5b12650c
C:\Windows\System32\Ajinlllk.dll - ede78108139bdbfb1110ca3b20d0db17818900978f8d03377ca6ed1bda0b1a17

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

104.46.162.230
52.123.252.212
4.230.171.124
40.84.97.4
52.230.59.222
74.178.76.128
74.179.77.164
52.168.117.169
20.165.94.63
92.223.78.30
51.132.193.105
135.233.45.221
52.148.114.188
172.215.188.232
72.154.7.104
52.110.12.22
52.110.12.52

More Padodor samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report