MALICIOUS — 599_Rustock.bin
MALICIOUS — 599_Rustock.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Rustock family. 5 of 51 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
efc94fdac8753451e7070f0cccb1b8e2ba2ce9e6edd3378a7ac412a359a256e4 - SHA-1:
8aaea9fb6598c8fd379c43bce87d4eb643d7b1e1 - MD5:
4a5e58d6351c342f3edc145f6f4eeafe - imphash:
6526067e5b544d0d6fe6a3665af33aa6 - ssdeep:
384:ObZ1GfDA9yBC7fNXeSUvxIYepvRRMbzMly/HwIe9iArTg4:S1Gf89yBIXelBsly/HwOcTg - TLSH:
T1882A5C69983FC4E4E7C4C771AC038C0E50E2B8BDD6BD150C92E28D6B51F9A77A46045B - Submitted as: 599_Rustock.bin
- File type: pe · Size: 20480 bytes
- Verdict: malicious (100/100) · Family: Rustock
Detections (5 of 51 engines)
- ClamAV (daily): {MD5}bin.trojan.rustock.9256.UNOFFICIAL
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: TrojanDownloader:Win32/Rustock.A
- Emsisoft (Emergency Kit): Gen:Variant.Fragtor.153694
- Trellix Stinger (McAfee): Generic Trojan.hg
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 12 weighted signals:
- ClamAV (daily) flagged {MD5}bin.trojan.rustock.9256.UNOFFICIAL (rule
{MD5}bin.trojan.rustock.9256.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged TrojanDownloader:Win32/Rustock.A (rule
TrojanDownloader:Win32/Rustock.A) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.Fragtor.153694 (rule
Gen:Variant.Fragtor.153694) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged Generic Trojan.hg (rule
Generic Trojan.hg) - engine signal, weight 0.55, confidence 0.85 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://98.126.32.194/htqqahr.gif, http://209.31.180.144/htqqahr.gif, http://174.139.241.2/htqqahr.gif - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Contacted 5 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (4 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
181 behavior events · 2 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- searchapp.bundleassets.example
- desktop-hsgcbep
- v10.events.data.microsoft.com
- settings-win.data.microsoft.com
- config.edge.skype.com
- login.live.com
- fd.api.iris.microsoft.com
- windows.msn.com
- officeclient.microsoft.com
- licensing.mp.microsoft.com
- sdx.microsoft.com
- nav.smartscreen.microsoft.com
- www.bing.com
- fe3cr.delivery.mp.microsoft.com
- assets.msn.com
- dns.msftncsi.com
- oloobe.officeapps.live.com
- msedge.api.cdp.microsoft.com
Embedded URLs
- http://98.126.32.194/htqqahr.gif
- http://209.31.180.144/htqqahr.gif
- http://174.139.241.2/htqqahr.gif
- http://216.155.153.212/htqqahr.gif
Embedded domains
- inference.location.live.net
- aefd.nelreports.net
Embedded IP addresses
- 98.126.32.194
- 209.31.180.144
- 174.139.241.2
- 216.155.153.212
- 162.159.36.2
File paths
- F:\ogfxespvlsmqrkyyfne\y\n\objfre\i386\dunjjb.pdb
More Rustock samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report