MALICIOUS — e432a8bbc9fd459a161b88677bae73969000a2c5d6d81a934e4883135cea3470

MALICIOUS — e432a8bbc9fd459a161b88677bae73969000a2c5d6d81a934e4883135cea3470 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Astaroth family. 4 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: e432a8bbc9fd459a161b88677bae73969000a2c5d6d81a934e4883135cea3470
SHA-1: ef14da712c027f89e3b2220980c1105cd306ade9
MD5: 49efe963850c44dcdbc73826d061feae
imphash: 20f4c4fd9bf0988bc03c1a2af7210ad4
ssdeep: 768:OJQx6cYjH0x/ur+PGW5gllYSNW2F6Q95V/dZuGqhwWZw3ew3lw:2QxRQHgur/cgllYSNW2F6Q95xdZrqP
TLSH: T1F3363ADDC6A54FC2CEE2A415466490FDC302F8C644583ECA4781C12A7FE56A399B83F6
Submitted as: e432a8bbc9fd459a161b88677bae73969000a2c5d6d81a934e4883135cea3470
File type: pe · Size: 66884 bytes
Verdict: malicious (98/100) · Family: Astaroth

Detections (4 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Packed.Upatre-9771589-0
Microsoft Defender: Trojan:Win32/Astaroth.psyF!MTB
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Packed.Upatre-9771589-0 (rule Win.Packed.Upatre-9771589-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

1734 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\yokitoki.exe - 7199b18a055e4bd0aede579ece13469ced8e7fcf324a5dee6a69815cf5900195
5d280e1be119bb7e2fe89025ce60a465469cf0e4ce58122c4fc2f1593cd90a92 - 5d280e1be119bb7e2fe89025ce60a465469cf0e4ce58122c4fc2f1593cd90a92

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787797269&P2=404&P3=2&P4=iBI1vuTuZaTifY9jFjzI0ck%2fYCnVvdRTKjkFKqbrehAKmYNz%2f33udd6vtgOuYQ3kNkkWrSeK4IgLjUu320JHkA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://icanhazip.com/

Embedded domains

icanhazip.com

Embedded IP addresses

4.150.223.113
52.123.252.215
85.210.193.152
4.230.171.124
4.144.132.114
74.178.76.128
13.69.109.130
74.178.76.54
20.165.94.63
20.184.175.2
52.123.129.14
20.76.201.171
40.103.64.242
172.66.2.5
52.123.252.203
135.234.160.244
203.26.79.13
52.110.12.24
52.110.12.37
52.123.252.248
74.179.71.159
52.148.114.188
52.123.252.247
172.178.240.161
104.16.185.241

File paths

C:\Users\VIKAS\AppData\Local\Temp\Temp1_New_documents(2).zip\nvmlyqz.exe
C:\Documents
C:\zKPNeWUm.exe
C:\zcEH4opz.exe
C:\6OMvLUJP.exe
C:\GpdUdmx8.exe
C:\57c88e20fc54d28db42c6b5727f9a4ec90e18f95089cf8dec7a7e575d59b9b69
C:\Users\george\Desktop\software.exe
C:\dcbe4222d4e71da3656e25a100ebaac9102fa8ac1508c49f5e22d2956436f5dc
C:\Users\george\Desktop\yokitoki.exe
C:\47644cb705e2954775898c29dbaf3eb9d1dae3ae8f478f996c6105261cd1e555
C:\Users\admin\Downloads\yokitoki.exe
C:\Users\Virtual\AppData\Local\Temp\56c2e577dc47b757d0b24e8ac1242100425e0630d951ab313b7eda02311737cc.exe
C:\e3c129126f5b68e10c3d99f17c1fc4f31866796dd772869e30f4f821a72adbe4
C:\Users\Frank\Desktop\akEAcoie.exe
C:\Users\admin\Downloads\0759945b0fc8413641a2d268bdacf01483e15042a0c34d848be2566253e119a4.exe
C:\YEL6uoLj.exe
C:\Users\george\Desktop\program.exe

More Astaroth samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report