MALICIOUS — d0e552ceac8861b35167f14101ecedafea957b49cac0c9e9b078324955b487e9

MALICIOUS — d0e552ceac8861b35167f14101ecedafea957b49cac0c9e9b078324955b487e9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Cymt family. 6 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: d0e552ceac8861b35167f14101ecedafea957b49cac0c9e9b078324955b487e9
SHA-1: cba6f219790e46e2a0b5eb42aea5797df3dbafd8
MD5: 3f19652f498ea9487afe3f17e7a6e3fd
imphash: 84706849fa809feaa385711a628be029
ssdeep: 3072:hs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/K/Fnncrd5971c:hDeM7iNEkgiOb31k1EC8Jy5J
TLSH: T1B53E5B8D21497A56F2A54C28FC0909FE422FA8DA72F5FF641937C01F76BE52BA301125
Submitted as: d0e552ceac8861b35167f14101ecedafea957b49cac0c9e9b078324955b487e9
File type: pe · Size: 143360 bytes
Verdict: malicious (100/100) · Family: Cymt

Detections (6 of 56 engines)

ClamAV (daily): Win.Malware.Cymt-10023133-0
YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
Microsoft Defender: TrojanDownloader:Win32/Nemucod
Emsisoft (Emergency Kit): Trojan.Agent.CYZT
Trellix Stinger (McAfee): Downloader-FCJE!3F19652F498E
Kaspersky (KVRT): HEUR:Flooder.Win32.CoreWarrior.a

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Cymt-10023133-0 (rule Win.Malware.Cymt-10023133-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged TrojanDownloader:Win32/Nemucod (rule TrojanDownloader:Win32/Nemucod) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.CYZT (rule Trojan.Agent.CYZT) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Downloader-FCJE!3F19652F498E (rule Downloader-FCJE!3F19652F498E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Flooder.Win32.CoreWarrior.a (rule HEUR:Flooder.Win32.CoreWarrior.a) - engine signal, weight 0.55, confidence 0.85
Contacted 2 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.45, confidence 0.70
Embedded network infrastructure: http://wecan.hasthe.technology/upload, http://curl.haxx.se/docs/http-cookies.html - static signal, weight 0.35, confidence 0.60
Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

438 behavior events · 0 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\rifaien2-UYVA1jhGnpOi6FCh.exe - 849159ccec0711793ef38aae64f4ac10e824b4e75d76f45f9d29fd80e71414f3
C:\Users\analyst\AppData\Local\Temp\rifaien2-UVbuKr9YTxphv4oQ.exe - 3553c1cdb64cf2b5f25296dc24a84dea07e88c235319c314e556537db2f15856
C:\Users\analyst\AppData\Local\Temp\rifaien2-1XAe9SvOgbpWr2oI.exe - 58d5a4fe92c62d887c0ff42b4d4f0d47d6c4e6859a5c9063da4b5b6ec70c7ab0

Embedded URLs

http://wecan.hasthe.technology/upload
http://curl.haxx.se/docs/http-cookies.html
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

example.com
curl.haxx.se
wecan.hasthe.technology
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.14
52.123.252.213
57.155.104.224
4.230.171.124
52.253.84.76
74.179.77.164
13.89.179.12
74.178.240.61
104.18.33.89
92.223.78.30
104.21.59.199
52.110.12.14
52.110.12.28
72.153.5.136
52.148.114.188
52.110.12.46

More Cymt samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report