MALICIOUS — d863bd4169bfb07eb74e1d6f1219ebe230d3e841a3faa980497c2b43f56c7971

MALICIOUS — d863bd4169bfb07eb74e1d6f1219ebe230d3e841a3faa980497c2b43f56c7971 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Krucky family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: d863bd4169bfb07eb74e1d6f1219ebe230d3e841a3faa980497c2b43f56c7971
SHA-1: 1fb916036c8103c37dad25907dbf3c17fed73636
MD5: e8e4c19becf25b208e057f953f4e75d7
imphash: 87bed5a7cba00c7e1f4015f1bdae2183
ssdeep: 3072:sZegVckL3vI+eOUE/LWQTIITheOpYJ3u7:sZbL3vTX6QkUMVJ3u7
TLSH: T15D3B122C28D32585D6E28EB2862A5F7CF7A30D05381291739706299FC5C523BD31FD6A
Submitted as: d863bd4169bfb07eb74e1d6f1219ebe230d3e841a3faa980497c2b43f56c7971
File type: pe · Size: 107008 bytes
Verdict: malicious (100/100) · Family: Krucky

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:kkrunchy
ClamAV (daily): Win.Packed.Krucky-6941986-0
Detect It Easy (packer/type): DIE:kkrunchy
Microsoft Defender: Trojan:Win32/Krucky!pz
Emsisoft (Emergency Kit): Gen:Packer.Krucky.B.geW@aK7Q7nm
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Packed.Krucky-6941986-0 (rule Win.Packed.Krucky-6941986-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in tsk_05e7c274ac (pid 3692) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Krucky!pz (rule Trojan:Win32/Krucky!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Packer.Krucky.B.geW@aK7Q7nm (rule Gen:Packer.Krucky.B.geW@aK7Q7nm) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:kkrunchy (rule DIE:kkrunchy) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:kkrunchy (rule high-entropy-sections:kkrunchy) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:kkrunchy, kkrunchy - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

19518 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

002ba573beded58371b4ba7ad4efb4acde8dfa77bcbe8273f588df0519d12fb8 - 002ba573beded58371b4ba7ad4efb4acde8dfa77bcbe8273f588df0519d12fb8

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://twitter.com/pidoras6
http://www.virustotal.com/vtapi/v2/file/scan

Embedded domains

3w.ru
www.virustotal.com

Embedded IP addresses

20.184.175.13
52.253.84.76
4.230.171.124
104.18.33.89
34.54.88.138
20.42.179.192
57.155.101.212
72.153.5.135
52.148.114.188
52.110.12.16
162.159.140.229
52.110.12.44

More Krucky samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report