MALICIOUS — e39b3748f814503d0e1c3cc094a4cd4266ddaebe3a87269232d539358a612113

MALICIOUS — e39b3748f814503d0e1c3cc094a4cd4266ddaebe3a87269232d539358a612113 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Tedy family. 5 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: e39b3748f814503d0e1c3cc094a4cd4266ddaebe3a87269232d539358a612113
SHA-1: d3dfd0f2bc5fb0c313e1795792ce496b6ef4f82f
MD5: 2f9fc7c53c00bb95686ddced39567b8d
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 49152:6cOWvHKwsh0jw+W7SCfT4KG4+n3Okq31tU6rmlrvI:6cOgHK128pbG4yOkIKlj
TLSH: T1275A127E42BEA1F6F8F2E5176352149F10D6999F0CF122C8C454293A0A90E1F616FD2B
Submitted as: e39b3748f814503d0e1c3cc094a4cd4266ddaebe3a87269232d539358a612113
File type: pe · Size: 1960448 bytes
Verdict: malicious (99/100) · Family: Tedy

Detections (5 of 55 engines)

capa (capabilities): capability:execution/powershell
MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:;nC%,.text
ClamAV (daily): Win.Packed.Tedy-9956544-0
Microsoft Defender: Trojan:MSIL/AsyncRAT.G!MTB
Emsisoft (Emergency Kit): Gen:Variant.Barys.515717

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Packed.Tedy-9956544-0 (rule Win.Packed.Tedy-9956544-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 20 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
Embedded network infrastructure: 3.3.3.0, 2.0.9.0, 4.0.1.0 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:;nC%,.text - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (4 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

22378 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

233f7f81c49feabb80c3ebb3002b6a75d0c727c4890ca632305ee9696f0987cd - 233f7f81c49feabb80c3ebb3002b6a75d0c727c4890ca632305ee9696f0987cd

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787884573&P2=404&P3=2&P4=aZnWm9EgIKx9sm4IMQwZSg%2bZkxkOwKNPXurWK%2fSLHYxQyTN6J%2fOxYmtBvJhqYPZpCVczFIUb0Kf4fbHL%2frsv%2bg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
api.auth.gg

Embedded IP addresses

3.3.3.0
2.0.9.0
4.0.1.0
13.89.179.12
52.230.59.222
4.230.171.124
85.210.196.11
135.232.92.137
20.165.94.54
20.50.73.14
20.76.201.171
52.123.129.14
40.103.64.226
52.123.128.14
135.233.45.223
203.26.79.13
172.67.201.19
20.42.179.192
52.148.114.188
135.233.95.80
72.145.35.105
52.110.12.16
52.110.12.38

File paths

y:\^D
T:\@~
C:\Program

More Tedy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report