MALICIOUS — e4e44fe0aa7e1e2aa28faceee18aec39cc2fc0dac0bf3853cc399e2d8ebc8ae0

MALICIOUS — e4e44fe0aa7e1e2aa28faceee18aec39cc2fc0dac0bf3853cc399e2d8ebc8ae0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100). 4 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: e4e44fe0aa7e1e2aa28faceee18aec39cc2fc0dac0bf3853cc399e2d8ebc8ae0
SHA-1: ed2cb7dc0c03e5dffc00a63320a4c447e8048b23
MD5: db2be279648007d6da33a578dc71838c
imphash: 4dce2fa3d2a90cbd5604eb74159c77ab
ssdeep: 768:P0IrCWtUZ90Kv+xOF4/i/BEYkp7P6lweQDhDmpU5GFrrEzWsdSE0d8pUHIkI0I1G:PRMrkxO+2G40OIka1G
TLSH: T15738A5EB3649A882D1E2E21F5D0A7FDD04AE4680033B162C269E474F79C16FB5435E9C
Submitted as: e4e44fe0aa7e1e2aa28faceee18aec39cc2fc0dac0bf3853cc399e2d8ebc8ae0
File type: pe · Size: 77824 bytes
Verdict: malicious (100/100)

Detections (4 of 56 engines)

ClamAV (daily): Win.Trojan.VB-1207
Microsoft Defender: Virus:Win32/Zbot.A
Emsisoft (Emergency Kit): Trojan.GenericKDZ.87868
Kaspersky (KVRT): Trojan.Win32.ZbotPatched.a

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Trojan.VB-1207 (rule Win.Trojan.VB-1207) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Virus:Win32/Zbot.A (rule Virus:Win32/Zbot.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.87868 (rule Trojan.GenericKDZ.87868) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.ZbotPatched.a (rule Trojan.Win32.ZbotPatched.a) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Embedded network infrastructure: http://193.104.27.110/wtf/addon.rar, 193.104.27.110 - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

87551 behavior events · 3 ATT&CK techniques · 8 dropped files.

Dropped files

C:\Users\analyst\gxkoir.exe - fccddd812af2465d4a8047d4be301b9d812d917ebecb0d3b727536e288a81f4c
065d90f50051e0c520aa192caa7c384fe9c42b6a54ad7b4f9de718e700647035 - 065d90f50051e0c520aa192caa7c384fe9c42b6a54ad7b4f9de718e700647035
63bde555ce8fa65b14b31ae2047183ff386c1649decf0ead1a57ef264f82ecac - 63bde555ce8fa65b14b31ae2047183ff386c1649decf0ead1a57ef264f82ecac
3937db9a4fde27830d245f161e1593c63b7dc352d978711ef47d5bc9ad6801c4 - 3937db9a4fde27830d245f161e1593c63b7dc352d978711ef47d5bc9ad6801c4
3f13db4f6802a3a32c000a74112999bb88b1ac67bab6023c399a8e00582ef58d - 3f13db4f6802a3a32c000a74112999bb88b1ac67bab6023c399a8e00582ef58d
a8e9bf1aadd4e4d2b2c8d058bcbb1d675b263e043319938ff55e77a13fcc9d7c - a8e9bf1aadd4e4d2b2c8d058bcbb1d675b263e043319938ff55e77a13fcc9d7c
ffcfa17d842d650156d8c4cb7893f5e9581955be3b745d9946207f6862679213 - ffcfa17d842d650156d8c4cb7893f5e9581955be3b745d9946207f6862679213
ac6bbe40fc91f5ee4265f9c89ed96c8c6c8e016f24cc57b044a5553c14a48315 - ac6bbe40fc91f5ee4265f9c89ed96c8c6c8e016f24cc57b044a5553c14a48315

Embedded URLs

http://193.104.27.110/wtf/addon.rar
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

ns2.epictureh.net

Embedded IP addresses

193.104.27.110
51.11.192.48
52.230.59.222
52.123.252.227
4.230.171.124
135.232.92.97
172.215.188.232
20.165.94.63
4.150.223.97
57.154.63.210
52.110.12.47
135.234.160.246
72.153.5.135
52.148.114.188
52.110.12.26
52.110.12.56

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report