MALICIOUS — eabc7800665a129cdc84e6af8b2a008e2c13f31128e61205a18618aa8163e677

MALICIOUS — eabc7800665a129cdc84e6af8b2a008e2c13f31128e61205a18618aa8163e677 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Crypted family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: eabc7800665a129cdc84e6af8b2a008e2c13f31128e61205a18618aa8163e677
SHA-1: a0884ae12b70740d1286c92312400ae41b9c3b17
MD5: 936d307353b193637a9a0d21ad62a2b6
imphash: c2a87fabf96470db507b2e6b43bd92eb
ssdeep: 1536:Ti2dOFAcebI3wCM43wIBsq0NYarTjb5D4p5Y9DMhOm3PJkKk062vi7Qb:uVh3wUarTjb5Dm2D2Om3h+0PcQb
TLSH: T1D23CBF27EAB9D69ACFE4AE4803F4B98D8F7510A121B1CA571BD6633CCD189C3B314158
Submitted as: eabc7800665a129cdc84e6af8b2a008e2c13f31128e61205a18618aa8163e677
File type: pe · Size: 114688 bytes
Verdict: malicious (99/100) · Family: Crypted

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Crypted-30
Microsoft Defender: Backdoor:Win32/Berbew!pz
Emsisoft (Emergency Kit): GenPack:Generic.Dacic.1.Backdoor.Hangup.A.8D3133A2
Trellix Stinger (McAfee): Trojan-FUGH!936D307353B1
Kaspersky (KVRT): Trojan-Proxy.Win32.Qukart.vjh

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Trojan.Crypted-30 (rule Win.Trojan.Crypted-30) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Backdoor:Win32/Berbew!pz (rule Backdoor:Win32/Berbew!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged GenPack:Generic.Dacic.1.Backdoor.Hangup.A.8D3133A2 (rule GenPack:Generic.Dacic.1.Backdoor.Hangup.A.8D3133A2) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FUGH!936D307353B1 (rule Trojan-FUGH!936D307353B1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Proxy.Win32.Qukart.vjh (rule Trojan-Proxy.Win32.Qukart.vjh) - engine signal, weight 0.55, confidence 0.85
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Dropped 68 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

2218 behavior events · 1 ATT&CK techniques · 68 dropped files.

Dropped files

C:\Windows\System32\Acflofph.exe - 3173c67a018d99bab99951ec3dadbb1c36fb6128f3218ab86987a59490f33a58
C:\Windows\System32\Lgjdaeem.dll - 0b00aca9cfb45f74fec27e26f1ae2c232864661b98bf66c00de9758786af25ed
C:\Windows\System32\Jeehnm32.exe - dacc36a527d2ffad6bb1cc456734d88e898ccd98b48a81342d1402da51d9259c
C:\Windows\System32\Llmmle32.exe - 1b0bbb964574a995fa3bef86d394f82e03e6a524ce280b4cb47701a8d5cd21fc
C:\Windows\System32\Okfhpm32.exe - cda72508e37bc862c766e98a943cf9d0739e2bd331cb0662e6b806be3e645e31
C:\Windows\System32\Difcjhph.exe - 0ba3f377f4a2e2c91dfee85f20b151e974dde703293f069381986b081a3f6dda
C:\Windows\System32\Aihnbmjk.exe - bbdd42b602575e86fac87b2f4e0cef372873f9243b81774c2b76bfc5764260b0
C:\Windows\System32\Echcac32.dll - e6a90fd71a3d4cfa84174de197e8edfa9ecc752fb5dad3e9f9192d70d985bf5c
C:\Windows\System32\Picbjfpn.exe - bec9471693ee48ae10f0d008a9e2bd4d4af408b5c20e45235fbece1741a81fb1
C:\Windows\System32\Oimljgff.exe - 7d78a336661cc7e9f0f059b70295dfd1b5c130b23f27eab1c6f1ad16ae87af45
C:\Windows\System32\Nfhefcqb.dll - 93fae1715cb183316667fd0d4d05c7455bdb3360b175ed12b8958469c9dca9ac
C:\Windows\System32\Ejgckl32.exe - 1c79fda331232f2ff70d5a1e0d870af5e7f98b567a3ee4a9315012884b6feab4
C:\Windows\System32\Jjakhgod.dll - ed575dd612a580d9304c59c75b5f4c4d4222a7b289d0016721227ae20a85626c
C:\Windows\System32\Hkchhkdd.exe - 492ad020bc2e184281b082252014721c957150501d325d338f88eda40885980a
C:\Windows\System32\Ndfpnm32.exe - 8784981a9ede7f687f9ac61a400088c9db5b3699ec53ff89c4a82d93d0093065

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

4.150.223.114
52.253.84.76
4.144.132.223
4.230.171.124
104.18.33.89
57.155.101.212
135.233.45.221
4.247.188.233
52.148.114.188
52.110.12.44
52.110.12.53

More Crypted samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report