MALICIOUS — d87c56056f2eec90684185b8969fed7b2a4609a5eb6dd703580fd328b1f5a456

MALICIOUS — d87c56056f2eec90684185b8969fed7b2a4609a5eb6dd703580fd328b1f5a456 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Convagent family. 7 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: d87c56056f2eec90684185b8969fed7b2a4609a5eb6dd703580fd328b1f5a456
SHA-1: 48ba5cbde96b87c09eeb2dcdd7f424cc43377613
MD5: 6fb1d1b70662e94e244f6793406fdec0
imphash: c6b0bd85f63e549c0536b6fceee78e43
ssdeep: 12288:MLry/neyx7f/A64h9D3vDbzCihdYMhyYp9o+jUOBuhxaaU3GOWjueT:qKeyxTAJXjfz3dYs1Nb2aaU3GOWjueT
TLSH: T1225233818166360AD3C8C09A8F3D6EDD7FD50AEFB549602531D913D726E9817A10CFB2
Submitted as: d87c56056f2eec90684185b8969fed7b2a4609a5eb6dd703580fd328b1f5a456
File type: pe · Size: 941583 bytes
Verdict: malicious (98/100) · Family: Convagent

Detections (7 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
ClamAV (daily): Win.Malware.Vmprotect-9878104-0
YARA: Yara-Rules community: YR_Packer_VMProtect
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Jaik!pz
Emsisoft (Emergency Kit): Gen:Variant.Barys.160809
Kaspersky (KVRT): HEUR:Trojan.Win32.Convagent.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Vmprotect-9878104-0 (rule Win.Malware.Vmprotect-9878104-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Contacted 22 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_Packer_VMProtect (rule YR_Packer_VMProtect) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Themida/VMProtect, high-entropy-sections:.vmp1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

99 behavior events · 0 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Program Files (x86)\sqrosvvg\pezsjlimoznbm.exe - 5fdb41da10c6cb3e586d71e54fe93329b6878e72457f6f14a7ac2dd87fce85a1
686f8134981cae210991951d9946903594b4b815a1d1f75efdac3643f1c44c4f - 686f8134981cae210991951d9946903594b4b815a1d1f75efdac3643f1c44c4f

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787741144&P2=404&P3=2&P4=YrhMEoieLHO1qW2D6qEvNchOnBBR2q0hTjIYTGGE8dzJFcWZ%2bUSM2xJFkiC8Vx6mvCu6KNuOXMVDsEzbix8OSw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

s.us

Embedded IP addresses

4.150.223.105
52.123.252.223
4.247.188.224
4.230.171.124
52.230.59.222
135.232.92.137
4.150.223.99
74.178.240.51
142.251.42.99
20.76.201.171
52.123.128.14
4.150.223.114
52.110.12.16
172.178.240.161
74.178.240.61
52.123.252.224
72.153.5.60
20.165.94.46
52.148.114.188
203.26.79.13
52.110.12.21
52.110.12.8

File paths

Z:\X]

More Convagent samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report