MALICIOUS — d3162d2e360e84943b91d47cd8b1a43a0e627d0f5f29ea68b3b5a0e307b41ae3

MALICIOUS — d3162d2e360e84943b91d47cd8b1a43a0e627d0f5f29ea68b3b5a0e307b41ae3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Krucky family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: d3162d2e360e84943b91d47cd8b1a43a0e627d0f5f29ea68b3b5a0e307b41ae3
SHA-1: 83d62f126e82ff4dae93dc3d8ac7e73c43fc7ebc
MD5: 2ebb8b36cf742cc0ebaa798e10206ed1
imphash: 87bed5a7cba00c7e1f4015f1bdae2183
ssdeep: 3072:dZegVckL3vI+eOUE/LWQTIITheOpYJ3u7:dZbL3vTX6QkUMVJ3u7
TLSH: T1BD3B122C28D32585D6E28EB2862A5F7CF7A30D05381291739706299FC5C523BD31FD6A
Submitted as: d3162d2e360e84943b91d47cd8b1a43a0e627d0f5f29ea68b3b5a0e307b41ae3
File type: pe · Size: 107008 bytes
Verdict: malicious (100/100) · Family: Krucky

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:kkrunchy
ClamAV (daily): Win.Packed.Krucky-6941986-0
Detect It Easy (packer/type): DIE:kkrunchy
Microsoft Defender: Trojan:Win32/Krucky!pz
Emsisoft (Emergency Kit): Gen:Packer.Krucky.B.geW@aSLIPVf
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Packed.Krucky-6941986-0 (rule Win.Packed.Krucky-6941986-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in tsk_081305f25c (pid 6024) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Krucky!pz (rule Trojan:Win32/Krucky!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Packer.Krucky.B.geW@aSLIPVf (rule Gen:Packer.Krucky.B.geW@aSLIPVf) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:kkrunchy (rule DIE:kkrunchy) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:kkrunchy (rule high-entropy-sections:kkrunchy) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:kkrunchy, kkrunchy - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

19859 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

05583c763f9bfe457bc8b9f26b30ad35a57f13f61e4a18ede953736ebf110b88 - 05583c763f9bfe457bc8b9f26b30ad35a57f13f61e4a18ede953736ebf110b88

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://twitter.com/pidoras6
http://www.virustotal.com/vtapi/v2/file/scan
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

3w.ru
www.virustotal.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.23
52.123.252.195
20.42.179.192
4.230.171.124
74.178.76.128
4.150.223.108
74.178.240.51
20.247.185.124
20.42.65.88
34.54.88.138
52.110.12.52
52.110.12.4
20.42.72.131
20.42.179.204
52.110.12.50
162.159.140.229
52.148.114.188
72.145.35.106

More Krucky samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report