MALICIOUS — c860042dfbfe5f6baeee0af275947f612c1480aea396899936c5ffd7d46720ba

MALICIOUS — c860042dfbfe5f6baeee0af275947f612c1480aea396899936c5ffd7d46720ba is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Vmprotect family. 7 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: c860042dfbfe5f6baeee0af275947f612c1480aea396899936c5ffd7d46720ba
SHA-1: 61f98b2104221bf6cbed1ef3242bd0bcaaed5b7e
MD5: 3033a6708a731f2b76c686aa859d396f
imphash: f11f87642badc84e7fb44e3ac9b293a4
ssdeep: 12288:GsE05umZPem7nAW04hrr5px3V2HYnMK5ODfHqpF:hZ5u8PemjFrzx3ocMLD/q
TLSH: T1454B231EDC35C04ED489E2F68E14BB5E494819EA33B9F74D1067C7E85A78DAF8207860
Submitted as: c860042dfbfe5f6baeee0af275947f612c1480aea396899936c5ffd7d46720ba
File type: pe · Size: 507703 bytes
Verdict: malicious (96/100) · Family: Vmprotect

Detections (7 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
ClamAV (daily): Win.Malware.Vmprotect-9910773-0
YARA: Yara-Rules community: YR_Packer_VMProtect
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/barys.RDB!MTB
Emsisoft (Emergency Kit): Gen:Variant.Barys.160809
Kaspersky (KVRT): HEUR:Trojan.Win32.Convagent.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 96/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Malware.Vmprotect-9910773-0 (rule Win.Malware.Vmprotect-9910773-0) - engine signal, weight 0.90, confidence 0.95
Contacted 24 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_Packer_VMProtect (rule YR_Packer_VMProtect) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Themida/VMProtect, high-entropy-sections:.vmp1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

122 behavior events · 0 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Program Files (x86)\ydta\vhrgqgbqi.exe - 19df45cf27e383e2c73152314a47dc98c26c362e59883e0c4661486ae4870861
80c7f3bbabc27d6dc31fbe4d61a168517bc13bba1eb4ba1c1331907ace3da66e - 80c7f3bbabc27d6dc31fbe4d61a168517bc13bba1eb4ba1c1331907ace3da66e

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787826685&P2=404&P3=2&P4=fVQmIy77YNaMHInoqiN%2fbPQLBqMCYtnqjyIUKW7AjKKv%2fV534EbUpkZ3vsmSMfRcXUnS23niYyekJA3%2ftigG4g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

o9f.cn

Embedded IP addresses

52.182.141.63
52.230.59.222
40.84.85.40
4.230.171.124
135.233.95.144
20.42.65.93
74.178.76.54
40.99.133.226
20.76.201.171
52.123.129.14
52.123.128.14
40.103.64.242
52.123.252.213
172.178.240.163
162.159.142.9
52.110.12.3
203.26.79.13
52.110.12.10
92.223.78.30
52.148.114.188
74.178.76.44
72.154.7.100
52.110.12.42
52.110.12.49

File paths

Y:\e5
W:\\y

More Vmprotect samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report