MALICIOUS — da9c6e6d5255d8e36d328901a46cdaf13fba276f54521e0976424cd0a84d3096

MALICIOUS — da9c6e6d5255d8e36d328901a46cdaf13fba276f54521e0976424cd0a84d3096 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Virtob family. 3 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: da9c6e6d5255d8e36d328901a46cdaf13fba276f54521e0976424cd0a84d3096
SHA-1: 19b742cdd7efb8dbdc0e36cb59dd903e145dc856
MD5: 55d763a3bbff9bb83945f4320b355576
imphash: 296a1716f69fc4b5e889fb2c7f98cfa1
ssdeep: 12288:ijQJGJ17jTmqpq1Zi2HnGPLIwgjjyp21ZZi:CQJGJIy0ILIwwj6Ki
TLSH: T14E4C7CDD911C2B8FC2398A231164DAFE3924B8D655747DCC1F44C927609AE3BEC321A9
Submitted as: da9c6e6d5255d8e36d328901a46cdaf13fba276f54521e0976424cd0a84d3096
File type: pe · Size: 542720 bytes
Verdict: malicious (96/100) · Family: Virtob

Detections (3 of 56 engines)

YARA: Yara-Rules community: YR_AntiDebug_Checks
Emsisoft (Emergency Kit): Win32.Virtob.Gen.12
Kaspersky (KVRT): Virus.Win32.Virut.ce

MITRE ATT&CK

T1071.001

Why this verdict

The malicious score of 96/100 is the fusion of 9 weighted signals:

Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in tsk_219e1cf136 (pid 3824) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virtob.Gen.12 (rule Win32.Virtob.Gen.12) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Virut.ce (rule Virus.Win32.Virut.ce) - engine signal, weight 0.55, confidence 0.85
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://ajax.aspnetcdn.com/ajax/jquery.ui/1.10.0/themes/redmond/jquery-ui.css, http://jqueryui.com/about, http://jquery.org/license - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Extracted generic config (5 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

90 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/1999/xhtml
http://ajax.aspnetcdn.com/ajax/jquery.ui/1.10.0/themes/redmond/jquery-ui.css
http://jqueryui.com/about
http://jquery.org/license
http://docs.jquery.com/UI/Tabs#theming
http://ajax.aspnetcdn.com/ajax/jquery/jquery-1.9.0.js
http://ajax.aspnetcdn.com/ajax/jquery.ui/1.10.0/jquery-ui.js
http://schemas.microsoft.com/SMI/2011/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

proc.name
this.name
policy.name
tool.name
www.w3.org
ajax.aspnetcdn.com
jqueryui.com
jquery.org
docs.jquery.com
schemas.microsoft.com

Embedded IP addresses

20.247.185.124
51.116.253.170
4.230.171.124
4.247.188.233
4.150.223.109
52.168.112.66
57.155.101.212
72.145.35.111
52.148.114.188
52.110.12.24

Registry keys

HKEY_CURRENT_USER\Software\Microsoft\Internet
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell
HKEY_CURRENT_USER\Software\Wow6432Node\Microsoft\Internet

File paths

c:\123\
d:\os\public\amd64fre\internal\strongnamekeys\fake\windows.snk

More Virtob samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report