MALICIOUS — d7ab80bece2d6cd76a0a0c79a7b8efbaf98d99f9fc874619e437dd98d989584c

MALICIOUS — d7ab80bece2d6cd76a0a0c79a7b8efbaf98d99f9fc874619e437dd98d989584c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Filerepmalware family. 3 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: d7ab80bece2d6cd76a0a0c79a7b8efbaf98d99f9fc874619e437dd98d989584c
SHA-1: 69af286933b2fd61fa6f0bf1880d87311e5a408f
MD5: c32984f7c49b1641b87dcd84f3b595ab
imphash: eb5bc6ff6263b364dfbfb78bdb48ed59
ssdeep: 98304:R1QTv0ZIEkG0jS7QjBpbGzs4PD/5gXSp7TJH3m8ChsJY/:Xw+IEkFLjB9PGGXcPcf/
TLSH: T10363F1B972175822C7A7774055A6F47E89DBB4D352BB851C40E7872EC9E23CF20B4288
Submitted as: d7ab80bece2d6cd76a0a0c79a7b8efbaf98d99f9fc874619e437dd98d989584c
File type: pe · Size: 5027500 bytes
Verdict: malicious (99/100) · Family: Filerepmalware

Detections (3 of 56 engines)

ClamAV (daily): Win.Malware.Filerepmalware-9908417-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Kaspersky (KVRT): UDS:DangerousObject.Multi.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Filerepmalware-9908417-0 (rule Win.Malware.Filerepmalware-9908417-0) - engine signal, weight 0.90, confidence 0.95
Kaspersky (KVRT) flagged UDS:DangerousObject.Multi.Generic (rule UDS:DangerousObject.Multi.Generic) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Embedded network infrastructure: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline - static signal, weight 0.35, confidence 0.60
Dropped 9 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

13200 behavior events · 2 ATT&CK techniques · 22 dropped files.

Dropped files

c:\program files (x86)\ckhunter\unins000.exe - 8a7cc1641c3187811c2a6695de5fe7265b0238686e3566325238a432daf7820c
C:\Users\analyst\AppData\Local\Temp\is-MQ5GE.tmp\_isetup\_setup64.tmp - 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
C:\Users\analyst\AppData\Local\Temp\is-SOHDH.tmp\tsk_f8888d5926704e09.tmp - 0e4c8658b174aa18e1f135a1fcb640a820ecf44efa8055309db1d5ddebc2251d
C:\Program Files (x86)\ckHunter\unins000.dat - eeb34a4d05d04dce641a14440b2baf1b5e1b4deb5f26a96230f789c04bb80253
C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000024.db - 183c2c808f190d5d697584ec85f49efcd4d9a2214cc7392b876fd6716c953925
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ckHunter\ckHunter.lnk - bed64d68d36b3e9958f1d8ca6530e5adb09de7cfd3ee45106516c10347efe4ef
c:\program files (x86)\ckhunter\crdllunload64.dll - 0b28d446fdd3eae2c6532cf4611765fa4ca9fedfba6fb564ad1e4eb46420613a
c:\program files (x86)\ckhunter\history.txt - 59df86ecd4822f5fe077ca078dae25bfd19d052b6bb375c8e9010c7b86244ee2
C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000023.db - 72d6b5c3b44a19e3f185593ebfef8cdd10d7705ffe089db2b4cc51b575e0b193
c:\program files (x86)\ckhunter\usrfindhandle64.sys - b288dfec2bb19509eca5b659c022db1ac80534c2eb06f6f792d563e655cd5a71
C:\Users\analyst\AppData\Local\Temp\{e9403ce1-7bb5-4ac7-b704-cf134070a4c2}.png - f3335e652639a387b7532280039027c9102a7da2b28ce72b336c4634b002c768
c:\program files (x86)\ckhunter\ckhunter.exe - 91371c4c96c9ea941245b8fd1c3dee0c3f8eb426f20ecb5ab8225ed6e8962848
C:\Users\analyst\AppData\Local\Temp\is-MQ5GE.tmp\_isetup\_iscrypt.dll - 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
c:\program files (x86)\ckhunter\crdllunload32.dll - 6468cb2a3d578efba32239c1c2c4676b4ddc3af4da59c8a3cec1adb6adf76930
c:\program files (x86)\ckhunter\lhshellext32.dll - d0894fb05471025253d7d002678157ace15d5e1d960a2470ee1f83f2d9a9a4d5

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

schemas.microsoft.com
qu.io
vd.es
y1.ga
www.jrsoftware.org
olustgtapi.live

Embedded IP addresses

20.50.73.14
4.144.132.114
4.230.171.124
85.210.196.11
20.165.94.54
52.168.112.67
74.178.240.61
4.150.223.103
172.178.240.163
135.234.160.245
52.110.12.51
52.110.12.30
162.159.142.9
72.154.7.109
52.148.114.188
52.110.12.50
52.110.12.14

File paths

A:\wo:
x:\dirname

More Filerepmalware samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report