MALICIOUS — ee2bd9d4157791cc95a78cb00b764c947e9c71fff34a9f35b53fb5bb77e75b0b

MALICIOUS — ee2bd9d4157791cc95a78cb00b764c947e9c71fff34a9f35b53fb5bb77e75b0b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fasong family. 8 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: ee2bd9d4157791cc95a78cb00b764c947e9c71fff34a9f35b53fb5bb77e75b0b
SHA-1: 8aaa378eeaf978012bd67b08f1f3e8d989e0964c
MD5: afaa8e53b5bd704e652f47b44ad4a7e8
imphash: 143ce2a6a5d4393bd4c950cf26bac42a
ssdeep: 24576:pqEkfFONkoqGqEkfFONkoqqqEkfFONkoqGqEkfFONkoq:pq2koqGq2koqqq2koqGq2koq
TLSH: T1695D9D7E17277603EEFACA141E74AE0D0435F85A0479188C666B84BEF3E9C6F1540B68
Submitted as: ee2bd9d4157791cc95a78cb00b764c947e9c71fff34a9f35b53fb5bb77e75b0b
File type: pe · Size: 2733666 bytes
Verdict: malicious (100/100) · Family: Fasong

Detections (8 of 55 engines)

capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Worm.Fasong-2
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Worm:Win32/Fasong!pz
Emsisoft (Emergency Kit): Gen:Trojan.ShellReg.MoZ@auJ2VRjb
Kaspersky (KVRT): Trojan.Win32.Scar.ofhn

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Worm.Fasong-2 (rule Win.Worm.Fasong-2) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 3 finding(s), e.g. RWX/private injected region in VQCDCDT.EXE (pid 3500) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 18 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.netmastersllc.com - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX, Turbo Linker - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 5 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

634 behavior events · 3 ATT&CK techniques · 9 dropped files.

Dropped files

C:\filedebug - 111963ea158aae616f404cb4934f22310d63df46a449aedf59f0403bd41c609c
C:\PPLFaultTemp\QKTPZ.EXE - 43c4ea2a98267e9ad34b201a4da877645da16c5928a5644e0ace3640a666053b
4e17ee15959ab661acef3d4d3b745ce501adaedaa845262a690b2a468195c7c7 - 4e17ee15959ab661acef3d4d3b745ce501adaedaa845262a690b2a468195c7c7
C:\$WinREAgent\GSF.EXE - 8ab94058ffca0eb32c46cc76c13332b652aabeafc3efb06f81618d43929d58a2
C:\Program Files\HZHXMS.EXE - 2a7794ab82c3f584fed1d76ad4f1fb6229aaad28715e2f4b5299be3e03c83cd7
C:\PPLFaultTemp\PGBRS.EXE - 7a1e833fbaf58bbecb34ac72d6e7be66452ff9628544ac443710bb6a0ccadb20
12ada70e3ab34b955f4e8c243e62b75672170a26d7e2e947d235bc7befaf0e5d - 12ada70e3ab34b955f4e8c243e62b75672170a26d7e2e947d235bc7befaf0e5d
177a1ec000cd592f3d73d2cc8c736e7d4311ae94eaf065de77253254d479599a - 177a1ec000cd592f3d73d2cc8c736e7d4311ae94eaf065de77253254d479599a
C:\Users\VQCDCDT.EXE - 9a0d37c69aa4580ff223b004f97353720f3675e78cd3517c471d8c67fac168cf

Embedded URLs

http://www.netmastersllc.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787849163&P2=404&P3=2&P4=h4xgyrzzgwMHGIaGAafuubGKudPqjRu9MLmQtRQcQalTUfWsuVdxcbPOIxL3j%2fYFl3ETqYFnIAxAsaEJnHL4Nw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787849213&P2=404&P3=2&P4=FIk20wx0xPe%2bGLGUGKE0rXpRXGeMyd3wCuCpb37o1t%2bS9WIzhLSSeMFUthjAwCX26XQRRZRf1ccYMHcYBNjT8g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

netmastersllc.com
www.netmastersllc.com

Embedded IP addresses

4.150.223.104
4.247.188.233
4.144.132.114
4.230.171.124
135.232.92.137
20.184.175.20
74.178.76.54
20.231.239.246
40.99.133.242
52.123.128.14
52.123.129.14
20.42.65.94
135.233.45.223
203.26.79.13
52.148.114.188
135.232.92.34
72.153.5.139
52.110.12.28

File paths

c:\filedebug
T:\:d:l:t:
X:\:`:d:h:l:
X:\:`:d:h:l:p:t:x:
X:\:t:
V:\:b:w:
X:\:`:d:

More Fasong samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report