MALICIOUS — d9fb9a0cd60dc990eb04eb16e1eaa35e550787edff2c5e0737ce38546c70b6da

MALICIOUS — d9fb9a0cd60dc990eb04eb16e1eaa35e550787edff2c5e0737ce38546c70b6da is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Convagent family. 7 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: d9fb9a0cd60dc990eb04eb16e1eaa35e550787edff2c5e0737ce38546c70b6da
SHA-1: 6bf4e1c6ce2306fe95b4e3fc652f967afad10df4
MD5: d78f8c0cf3ee9f4d0d077ca61a573eef
imphash: c6b0bd85f63e549c0536b6fceee78e43
ssdeep: 24576:qKeyxTAJj7P+yW6mc1YLYJbs30havOVy//HlJAqy7:qKeyRA0y9fWLYucLVWs7
TLSH: T16D55339912047332E44B900FEA2A6C1F2F1B47AF268A51F47A7549DE6F71D8B540CBE0
Submitted as: d9fb9a0cd60dc990eb04eb16e1eaa35e550787edff2c5e0737ce38546c70b6da
File type: pe · Size: 1256857 bytes
Verdict: malicious (98/100) · Family: Convagent

Detections (7 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
ClamAV (daily): Win.Malware.Vmprotect-9878104-0
YARA: Yara-Rules community: YR_Packer_VMProtect
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Jaik!pz
Emsisoft (Emergency Kit): Gen:Variant.Barys.160809
Kaspersky (KVRT): HEUR:Trojan.Win32.Convagent.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Vmprotect-9878104-0 (rule Win.Malware.Vmprotect-9878104-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Contacted 20 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_Packer_VMProtect (rule YR_Packer_VMProtect) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Themida/VMProtect, high-entropy-sections:.vmp1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

103 behavior events · 0 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Program Files (x86)\jckgj\fifn.exe - da8ef1d3421a570636be227ec92338faa3d62b44dd2e539a833f0cbcdc68b6ec
be09d35898e2a23597f253a206c1d445d2a90b9f62417f33e46e74259904ddf3 - be09d35898e2a23597f253a206c1d445d2a90b9f62417f33e46e74259904ddf3

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787926578&P2=404&P3=2&P4=EVD9QMOeNN%2bei0wXA29H230OszOk1v0jVVoTx8MjcuK8Yn2kW2OmXtOBui%2bZeuCWCa9D0xzd%2bQZcxcpx3QufMA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

s.us
yi.ch
o.tv

Embedded IP addresses

52.168.117.174
52.123.252.227
4.247.188.224
52.230.59.222
4.230.171.124
74.178.76.128
4.150.223.105
135.232.92.97
52.182.141.63
20.231.239.246
52.123.128.14
52.123.129.14
40.99.134.18
135.234.160.244
203.26.79.13
72.153.5.134
135.233.95.80
52.148.114.188
52.110.12.22
52.110.12.3

File paths

Z:\X]

More Convagent samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report