MALICIOUS — e684ecf37ab84c93db29b6e6938523fe7007f9b1f51c2fd2ca96cdf08a1e183c

MALICIOUS — e684ecf37ab84c93db29b6e6938523fe7007f9b1f51c2fd2ca96cdf08a1e183c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Vtflooder family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: e684ecf37ab84c93db29b6e6938523fe7007f9b1f51c2fd2ca96cdf08a1e183c
SHA-1: 27df553806cedfcd82e39bc1b2d9036b976b8e6d
MD5: 9e6595c82b5c71bce070b3862064dfd9
imphash: 3d8c26f4cb1782a87c3bb42796fb6b85
ssdeep: 192:tvBJqALnfeSAZC813/D1ZhbzM60lkwiRK:nUALGZM3lke
TLSH: T15D1F9489F6180E1CCF73EF6BCD5A8A8C646451F810E218083DCBC47967B4C67E8A902C
Submitted as: e684ecf37ab84c93db29b6e6938523fe7007f9b1f51c2fd2ca96cdf08a1e183c
File type: pe · Size: 7168 bytes
Verdict: malicious (100/100) · Family: Vtflooder

Detections (5 of 56 engines)

ClamAV (daily): Win.Malware.Vtflooder-9783271-0
Microsoft Defender: Trojan:Win32/Vflooder!pz
Emsisoft (Emergency Kit): Gen:Variant.Razy.646374
Trellix Stinger (McAfee): VTFlooder!9E6595C82B5C
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Vtflooder-9783271-0 (rule Win.Malware.Vtflooder-9783271-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in tsk_88f80c4c33 (pid 8928) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Vflooder!pz (rule Trojan:Win32/Vflooder!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Razy.646374 (rule Gen:Variant.Razy.646374) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged VTFlooder!9E6595C82B5C (rule VTFlooder!9E6595C82B5C) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 8 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

18749 behavior events · 2 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://www.virustotal.com/vtapi/v2/file/scan
http://twitter.com/pidoras6

Embedded domains

twitter.com
www.virustotal.com

Embedded IP addresses

40.79.167.9
52.123.252.227
4.155.94.229
4.230.171.124
20.165.94.54
20.42.179.192
4.150.223.105
74.178.76.128
172.64.154.167
20.50.201.203
34.54.88.138
4.150.223.103
4.207.44.75
172.215.188.225
52.110.12.51
52.110.12.42
52.148.114.188
162.159.140.229
72.153.5.136
92.223.78.30

More Vtflooder samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report