MALICIOUS — e71824e3d9232e950ef2f466788fc858f34f8378545863e7008481404f6a2d6c

MALICIOUS — e71824e3d9232e950ef2f466788fc858f34f8378545863e7008481404f6a2d6c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Viking family. 6 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: e71824e3d9232e950ef2f466788fc858f34f8378545863e7008481404f6a2d6c
SHA-1: 44ad3b2343c1c5ff3f908178a828d71f05e4ae5f
MD5: b541c1429e72a39123fa81dcfb9096d9
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 3072:qKtfDwsjPThTYszDH2flf8l2CHRGgKTBfik:BtfDwsjPThT5zL2ZaQgKTBKk
TLSH: T1633D9E25677A2B82DFF2CA331850BB5E1073B8F52072488C5693D09E7BE5C6768B425C
Submitted as: e71824e3d9232e950ef2f466788fc858f34f8378545863e7008481404f6a2d6c
File type: pe · Size: 125440 bytes
Verdict: malicious (100/100) · Family: Viking

Detections (6 of 55 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Delf-1564
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Viking.MS
Emsisoft (Emergency Kit): Trojan.Agent.FPMF
Kaspersky (KVRT): Virus.Win32.Lamer.xe

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Dropped a malicious payload (GameThief): virDll.dll - dynamic signal, weight 0.62, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
1 behavioral detection(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

56080 behavior events · 2 ATT&CK techniques · 83 dropped files.

Dropped files

C:\Program Files\LibreOffice\program\python-core-3.12.13\bin\python.exe - 5375b4512af26cc3fc754e5cccbf60cdb0917178349bddb41c99e43a60912183
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - e6fa464066d1e4d4b950fab0e6276ad84dde4c06149fa336d24221d18720ba0a
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26060.3008-0\DefenderAgentScan.exe - 6bf5d99d8b43735e3ba8580e875a8f7ee18be15f9ede3f33519321711e0b52db
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccesswalker.exe - a6b76127377f95b762e2522ecf3037cd37886562729bc69dd56669c724e160fa
C:\Python310-32\Scripts\pip.exe - f82fb810838eb5bb10f321e652ac1acb03f60b741ffeae29d502e7910321c076
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\w64.exe - 24d2fb6287d61896c486d6470d02468ebdfbdd16ff3bc0e403cfc2d46a77397d
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\LibreOffice\program\scalc.exe - a80d9d29367298114e9875de29c67352f786350af344f850e87fbc460590e559
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - ea39389ee88115dc61d97b0e0fe0519938e36e15a597b9ad66663481f37465be
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\t64.exe - 6bf070298fc83beb8cc74dfc383f02af1cbb9b9f45569ee16442f87802727d62
C:\Program Files\LibreOffice\program\uno.exe - f09420276a2c6ba0f7d52bd465025930651b1805fa31a8e73b97cfd4a316f185
C:\Program Files\LibreOffice\program\gengal.exe - 1c18d7f5906d24c0812365d71041a57161a0c36a7e0d3668272fc354f0a947fd
C:\Windows\virDll.dll - c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc
C:\Program Files\LibreOffice\program\quickstart.exe - 9570c578781290a9b2fed18d01e0cfe15aba7c1b7fa7380b16ab6869270593fd
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\klist.exe - b55f13c6768b6ea20b39610b3bb000a0ffe08961c2ef1cc433a37d014b09fa21

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787800578&P2=404&P3=2&P4=Y5qB2RUlZF9eLLUIHmRBUFs0NF7bnTE%2fdtw8AbjIkzMOAa6HMSu3Uy%2befYpRQplwGenZ8djo9B3I6LfY%2fSl9cw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787800622&P2=404&P3=2&P4=Ty0n04TVuGEGsXSeyR5oPKI5SPx1YFF%2fw9gSveWfW5ig%2fNMnKtb3oKpZOgPZqdqo0JrS5NiLUTTDygCBLrwHnw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

192.168.0.30
192.168.8.1
4.150.223.103
52.253.84.76
4.247.188.224
4.230.171.124
74.178.240.61
20.165.94.54
4.150.223.113
92.223.78.30
52.123.129.14
20.236.44.162
40.99.134.18
52.123.128.14
20.42.73.25
135.233.45.223
52.123.252.241
162.159.142.9
203.26.79.13
52.123.252.227
135.233.95.80
52.148.114.188
172.178.240.161
85.210.196.11
72.154.7.114

More Viking samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report