MALICIOUS — d2f6518712768cda4abab8845ea7a89225ca08821cbdb6705b19611ced9acefb

MALICIOUS — d2f6518712768cda4abab8845ea7a89225ca08821cbdb6705b19611ced9acefb is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Glupteba family. 5 of 25 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: d2f6518712768cda4abab8845ea7a89225ca08821cbdb6705b19611ced9acefb
SHA-1: b58f05edb714e3542e320c3e1f0c98a4a4e5f165
MD5: 44263405fe39b4b45e6797ec332cad19
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 3072:sCupogCl0vUGpoCMU/VsxSUqGfROyAgtYeNoMwXVU1nXzg1vyWZ:TupmllGuCMU/VsoiRHK7lWzgvyWZ
TLSH: T1154012599FC8F019C20652655072A4ACEB881F9FA6D5C35FEAEB16F225CA5333C608C4
Submitted as: d2f6518712768cda4abab8845ea7a89225ca08821cbdb6705b19611ced9acefb
File type: pe · Size: 173056 bytes
Verdict: malicious (99/100) · Family: Glupteba

Detections (5 of 25 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
Microsoft Defender: Trojan:Win32/Glupteba!pz
Emsisoft (Emergency Kit): Gen:Variant.Razy.870640
Trellix Stinger (McAfee): Glupteba-FUBP!44263405FE39
Kaspersky (KVRT): HEUR:Trojan.Win32.Copak.pef

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

Dropped a malicious payload (Glupteba): 304aeed136172961f34d9d840ed5fd53ccfd9ac593d1b12677e9b59d4513bb28 - dynamic signal, weight 0.80, confidence 0.90
Memory forensics: 4 finding(s), e.g. process hollowing in tsk_5ba7a93e50 (pid 3552) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.70, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Glupteba!pz (rule Trojan:Win32/Glupteba!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Razy.870640 (rule Gen:Variant.Razy.870640) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Glupteba-FUBP!44263405FE39 (rule Glupteba-FUBP!44263405FE39) - engine signal, weight 0.55, confidence 0.85
Contacted 61 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

113 behavior events · 1 ATT&CK techniques · 6 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/17880/files/304aeed136172961f34d9d840ed5fd53ccfd9ac593d1b12677e9b59d4513bb28 - 304aeed136172961f34d9d840ed5fd53ccfd9ac593d1b12677e9b59d4513bb28
c34eeb1cfafafd947460909b9eb5f2ec6d79a2155d7a462bd564b03a23399099 - c34eeb1cfafafd947460909b9eb5f2ec6d79a2155d7a462bd564b03a23399099
fcc253ea893e748eaa5c3eceec3cae12f3ed8c4f2c26129cd67e7e7bb21a8602 - fcc253ea893e748eaa5c3eceec3cae12f3ed8c4f2c26129cd67e7e7bb21a8602
03d37447bcb69ec39ea7cd3ac99c378c3840c1db09296971d47b4e9f80d555ce - 03d37447bcb69ec39ea7cd3ac99c378c3840c1db09296971d47b4e9f80d555ce
6577bced8e6b4a8c1b39f877a6ec08a1f4773a79ef02fbed78b32e00db406897 - 6577bced8e6b4a8c1b39f877a6ec08a1f4773a79ef02fbed78b32e00db406897
416d90eacfd6e5dda8d26bc1c3e26c293a85f3537b856fa0ee3d0c9c0ada88c4 - 416d90eacfd6e5dda8d26bc1c3e26c293a85f3537b856fa0ee3d0c9c0ada88c4

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

4.150.223.102
52.110.12.20
4.247.188.224
4.230.171.124
135.233.95.144
40.84.85.40
4.150.223.114
20.236.44.162
135.233.45.223
52.123.252.219
52.110.12.22
57.155.104.224
20.76.201.171
4.150.223.112
52.123.252.215
74.178.240.51
20.89.1.11
74.179.77.164
162.159.36.2
135.232.92.137
40.84.97.4
40.104.4.2
203.26.79.13
52.110.12.30
52.123.128.14

More Glupteba samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report