MALICIOUS — e41e394f688f31a5ef2717a0e9cf3f3028816c78c633b430e1d04a55c9bb3144

MALICIOUS — e41e394f688f31a5ef2717a0e9cf3f3028816c78c633b430e1d04a55c9bb3144 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Multiverze family. 5 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: e41e394f688f31a5ef2717a0e9cf3f3028816c78c633b430e1d04a55c9bb3144
SHA-1: 527b3872cea983e2e12e5c8d16362f1538671fd1
MD5: 89fd1386bb85106e1983d11a02948704
imphash: 9336d7d04a360eb315c5349e8522fbf7
ssdeep: 24576:FST1y7kXF6dhjyaBT1e0dq5U47d07qlyXb0DtMCpD7Xhp8RIi:FST1yUF2yaY5Ui072+CtMCpDLC
TLSH: T11E5123027034165EEB228534AF4A8F2DA847584130BDD8CCD61A49FEE9C9E3F945E4B7
Submitted as: e41e394f688f31a5ef2717a0e9cf3f3028816c78c633b430e1d04a55c9bb3144
File type: pe · Size: 851970 bytes
Verdict: malicious (99/100) · Family: Multiverze

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:sTmNB
ClamAV (daily): Win.Malware.Bymqszfb-9909040-0
Microsoft Defender: Trojan:Win32/Multiverze!rfn
Emsisoft (Emergency Kit): Gen:Variant.Fragtor.57200
Kaspersky (KVRT): HEUR:Packed.Win32.Vemply.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Bymqszfb-9909040-0 (rule Win.Malware.Bymqszfb-9909040-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Multiverze!rfn (rule Trojan:Win32/Multiverze!rfn) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Fragtor.57200 (rule Gen:Variant.Fragtor.57200) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Packed.Win32.Vemply.gen (rule HEUR:Packed.Win32.Vemply.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 2 external host(s) and 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:sTmNB (rule high-entropy-sections:sTmNB) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:sTmNB - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 5432) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

141 behavior events · 0 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\1B0A0B0B120D156C155E15D0B0C160F0B160E.exe - a1ae1fbcbd9ab8d5c2ce130173ed6d885fa2becaadca983264645a0ede64dc68
7f65ef30ced4a173489b24872977379723a1d22a95d4118392ad37234025fc19 - 7f65ef30ced4a173489b24872977379723a1d22a95d4118392ad37234025fc19

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

q.tv

Embedded IP addresses

13.69.109.131
4.230.171.124
40.84.97.4
52.230.59.222
104.46.162.231
74.178.76.54
74.179.77.204
52.178.17.235
52.123.252.225
20.165.94.63
52.110.12.11
52.110.12.10
52.110.12.28
172.64.154.167
52.110.12.48

File paths

C:\2

More Multiverze samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report