MALICIOUS — cb8fd8be04fddd69eff2fe89f86ca7b8f1795fd5233d178e68d516783dc0944b

MALICIOUS — cb8fd8be04fddd69eff2fe89f86ca7b8f1795fd5233d178e68d516783dc0944b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the VBInject family. 4 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: cb8fd8be04fddd69eff2fe89f86ca7b8f1795fd5233d178e68d516783dc0944b
SHA-1: b0d31100a581906f71a9cbe91703ed4d116479f4
MD5: 262102b0a92e2f3a9dacc226d339fec4
imphash: 8c2c298ae60f6ec09cbfa7ac4454438b
ssdeep: 3072:BU9VGAqmG0tQ9nLHbB9WHCS0AgTlhsp3mWe8:KqmG4QxL7B9WHK9Jhsp3R
TLSH: T13342F6CC2DEDD0D2C1B991035DA899FC398EEC9BB22B8375899A846720D21FB103557D
Submitted as: cb8fd8be04fddd69eff2fe89f86ca7b8f1795fd5233d178e68d516783dc0944b
File type: pe · Size: 204800 bytes
Verdict: malicious (100/100) · Family: VBInject

Detections (4 of 56 engines)

ClamAV (daily): Win.Trojan.Acnu-7601993-0
Microsoft Defender: Worm:Win32/Vobfus!pz
Emsisoft (Emergency Kit): Gen:Variant.VBInject.11
Kaspersky (KVRT): Worm.Win32.WBNA.jtx

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Trojan.Acnu-7601993-0 (rule Win.Trojan.Acnu-7601993-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Worm:Win32/Vobfus!pz (rule Worm:Win32/Vobfus!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.VBInject.11 (rule Gen:Variant.VBInject.11) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.WBNA.jtx (rule Worm.Win32.WBNA.jtx) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

46555 behavior events · 3 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\tmsib.exe - 0c8bb10cef41f6b3045f4ff100050f267ec495b1d3a394a5a8690f0775c57c08
11af6add754a1e1606f795bbd8f30bf3d0b5dece3d7abc94b9176b6910415628 - 11af6add754a1e1606f795bbd8f30bf3d0b5dece3d7abc94b9176b6910415628
64f2291be0ecc64d34ed77bb7634dd4285331a9e40602d8f21174c741c51f0b2 - 64f2291be0ecc64d34ed77bb7634dd4285331a9e40602d8f21174c741c51f0b2

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

ns1.musiczipz.com
ns1.musicmixa.net
ns1.musicmixa.org
ns1.musicmixb.co

Embedded IP addresses

51.11.192.51
20.247.184.197
20.42.179.204
4.230.171.124
135.233.95.135
135.232.92.137
20.42.65.91
135.233.95.144
92.223.78.30
40.84.97.4
52.110.12.8
52.110.12.48
172.178.240.162
4.150.223.97
72.153.5.130
52.148.114.188
52.110.12.33
52.110.12.49

File paths

C:\Program

More VBInject samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report