MALICIOUS — cc1310480bbe8ada477154a8558d94db7070561a111e64a87e95e4d2fecd529b

MALICIOUS — cc1310480bbe8ada477154a8558d94db7070561a111e64a87e95e4d2fecd529b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fasong family. 7 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: cc1310480bbe8ada477154a8558d94db7070561a111e64a87e95e4d2fecd529b
SHA-1: 83b5ff6115dfb3bccd10fb9f52c33deefaa0cda0
MD5: f184aaee47388728300593acfb7a96c2
imphash: 9a40b556f04c6c6d3d61394c56be6bd5
ssdeep: 6144:QbpGtfoVtScw2RCgrzItQBhbpGtfoVtScw2RCgrzItQB:iGtAtScw3qEKBnGtAtScw3qEKB
TLSH: T1D8491218B2992DC5C67D99ED201CA48E86D935683CBB5A3530B9C826D8B4B333D39760
Submitted as: cc1310480bbe8ada477154a8558d94db7070561a111e64a87e95e4d2fecd529b
File type: pe · Size: 416745 bytes
Verdict: malicious (100/100) · Family: Fasong

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Worm.Fasong-9908424-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Borland Delphi
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Gen:Heur.Mint.Zard.30
Kaspersky (KVRT): Trojan.Win32.Scar.ofhn

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Worm.Fasong-9908424-0 (rule Win.Worm.Fasong-9908424-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Mint.Zard.30 (rule Gen:Heur.Mint.Zard.30) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Scar.ofhn (rule Trojan.Win32.Scar.ofhn) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Borland Delphi (rule DIE:Borland Delphi) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Borland Delphi - static signal, weight 0.25, confidence 0.55
Dropped 7 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

653 behavior events · 3 ATT&CK techniques · 11 dropped files.

Dropped files

C:\$Recycle.Bin\RSG.EXE - 50bb5b548cb4bbc1cb4a4b9d365cedf49aada7fd5052bd6945c734391c57ea55
C:\Python3\PEFZYK.EXE - 2af4c82c6bba3383c427a36b31489a79cb8bc283b2b8a0299799c392d1253703
54302cb591f1939eba8e4cfddf826d78484755ec414b50488554c1c0d7e9f521 - 54302cb591f1939eba8e4cfddf826d78484755ec414b50488554c1c0d7e9f521
C:\filedebug - f2b59db203e9b39b2b847fd33248bd26cedf5b84c431cc1ff0202a1877495b22
C:\$Recycle.Bin\UTK.EXE - 02deaaae694caa7c20228a940a9541a463d21fd3f27ae8150085c565f7b31eed
C:\$WinREAgent\QDO.EXE - 61100ac74c00540229f2714cff0651928dba592babe26b6a37d1a34752efdd48
C:\PerfLogs\JJSCU.EXE - 0f3b5f3c63fc2e9ba7cf4168a2936b382c597aa0b670429aa2cfcd449415c083
C:\Program Files (x86)\PAECG.EXE - 46eddb6355c17267ae905957f9b7b62ba9b577bb727112590e8ed3ac296955df
C:\$Recycle.Bin\YHT.EXE - 511bb1aa690a2f2dfbe35fa59a28b44aeb5bbf91b9b34fe4678b38c507fd47ea
6064f961f32e87bb426c5af01c1c7363f69b386f5aaab1deb1d6935435825a9a - 6064f961f32e87bb426c5af01c1c7363f69b386f5aaab1deb1d6935435825a9a
b9b138662b94864998142de4a7ec857f34d43aee07157010f1ed6a5f39989340 - b9b138662b94864998142de4a7ec857f34d43aee07157010f1ed6a5f39989340

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

4.150.223.102
4.144.132.223
52.123.252.204
4.230.171.124
172.64.154.167
52.110.12.40
52.110.12.51
57.155.101.212
72.154.7.102
52.148.114.188
52.110.12.52

More Fasong samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report