MALICIOUS — d0ea774822937446b54b5f129a8c32bbb88ff1ebd4d965996b779330d15ebf43

MALICIOUS — d0ea774822937446b54b5f129a8c32bbb88ff1ebd4d965996b779330d15ebf43 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the VBChinky family. 4 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: d0ea774822937446b54b5f129a8c32bbb88ff1ebd4d965996b779330d15ebf43
SHA-1: cda84458f1265e0631572f266150c9232e0d4970
MD5: 92ef99e61dd9167d9c5036f6b69ff57d
imphash: 74a700ac5b845069d415423354fd8c51
ssdeep: 768:jKvw1owYOWJOao0hdO6XfLbM6eXJ9Oty/N/X+YVhP5itZfP6v+XyCW:evw1owctfUxjEmNfP8Sv+rW
TLSH: T19B3710D3A69CCCA1C4E1EA5B0D0C3FAD508D8BC87A7B802D06E9555A6DD58F3F02498D
Submitted as: d0ea774822937446b54b5f129a8c32bbb88ff1ebd4d965996b779330d15ebf43
File type: pe · Size: 73728 bytes
Verdict: malicious (100/100) · Family: VBChinky

Detections (4 of 56 engines)

ClamAV (daily): Html.Trojan.VBChinky-3
Microsoft Defender: Worm:Win32/Vobfus.AC
Emsisoft (Emergency Kit): Gen:Trojan.Chinky.2
Kaspersky (KVRT): Worm.Win32.Vobfus.exhd

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Html.Trojan.VBChinky-3 (rule Html.Trojan.VBChinky-3) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Worm:Win32/Vobfus.AC (rule Worm:Win32/Vobfus.AC) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Trojan.Chinky.2 (rule Gen:Trojan.Chinky.2) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.Vobfus.exhd (rule Worm.Win32.Vobfus.exhd) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

55847 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Users\analyst\mfyiub.exe - c3453416dd53d7cc8fd9c814bd112e688b1759262d270b2e48c7de9dfa650d88
3e58eac905992084032af3d040204064b999b3732bc09f6259d2468fa803be2d - 3e58eac905992084032af3d040204064b999b3732bc09f6259d2468fa803be2d
ef3c38bfbbe404081cc76e1c7c466df4b2e46579333db270d865925027f64403 - ef3c38bfbbe404081cc76e1c7c466df4b2e46579333db270d865925027f64403
89770da48ddfdb73d781f4eaf493b5a142a2d4420e9206e85a3ab3f9024374c2 - 89770da48ddfdb73d781f4eaf493b5a142a2d4420e9206e85a3ab3f9024374c2

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

ns3.thepicturehut.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.65.89
4.230.171.124
48.211.4.16
20.42.179.192
135.232.92.137
52.253.84.76
74.178.76.54
20.42.73.30
135.233.95.144
162.159.142.9
51.116.253.168
52.110.12.22
52.110.12.51
72.154.7.97
52.148.114.188
52.110.12.20
52.110.12.10

More VBChinky samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report