SUSPICIOUS — ebc8f301fbe5bb86cf5e82f2d2fc9d436db92de050e90d0764c0fb96aa8068b3

SUSPICIOUS — ebc8f301fbe5bb86cf5e82f2d2fc9d436db92de050e90d0764c0fb96aa8068b3 is a unknown sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (40/100), attributed to the Persistence family. 1 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: ebc8f301fbe5bb86cf5e82f2d2fc9d436db92de050e90d0764c0fb96aa8068b3
• SHA-1: a1ef98f82a38f63cab5b292fd703dee5ad6d1b65
• MD5: a4bb0ca9ff4e7d135a0d50fe7d5d0b99
• ssdeep: 3:ctm2KD9so3KRfyM1K7eDoKTAux1KUidJfNJRpE2J5xAIFK53jlmKDyn:cCtuH1j0K/9idJ1JRq23fujl9Dy
• TLSH: T1050C801D13DD9D1EDB4D10570513CB19F7010A691FDDA41514754DD1EC73632249D415
• Submitted as: ebc8f301fbe5bb86cf5e82f2d2fc9d436db92de050e90d0764c0fb96aa8068b3
• File type: unknown · Size: 165 bytes
• Verdict: suspicious (40/100) · Family: Persistence

Detections (1 of 50 engines)

• YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey

MITRE ATT&CK

• T1547.001

Why this verdict

The suspicious score of 40/100 is the fusion of 2 weighted signals:

• YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60

Registry keys

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run

File paths

• C:\Users\analyst\AppData\Local\Temp\GPGYQMHBBQROXDH\service.exe

More Persistence samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report