MALICIOUS — f14a678dde44c440a192439de17e306f4a6e3205b5f81394f9a498151cc16c10
MALICIOUS — f14a678dde44c440a192439de17e306f4a6e3205b5f81394f9a498151cc16c10 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the Eclz family. 5 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
f14a678dde44c440a192439de17e306f4a6e3205b5f81394f9a498151cc16c10 - SHA-1:
534bf85f176f27a48a1dae469b2ee5bf37567832 - MD5:
98ed7c624d08c8a31ab0a517125c134b - imphash:
e780223af31e5cc3f52e2ebb06482260 - ssdeep:
12288:dXCNi9Bg9+tjakO1RENYVdB/GIwwq2NRR6c:oWEKjYFVTeoJNRwc - TLSH:
T13D4A122211843E9CF4A31B91C2AEDF4E503751FDB6F2475AA747E04CB2D442B9B36298 - Submitted as: f14a678dde44c440a192439de17e306f4a6e3205b5f81394f9a498151cc16c10
- File type: pe · Size: 435191 bytes
- Verdict: malicious (92/100) · Family: Eclz
Detections (5 of 55 engines)
- ClamAV (daily): Win.Malware.Eclz-9953021-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Worm:Win32/Sfone!pz
- Emsisoft (Emergency Kit): Gen:Heur.Mint.Murphy.3
- Kaspersky (KVRT): Worm.Win32.Agent.cp
MITRE ATT&CK
Why this verdict
The malicious score of 92/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Win.Malware.Eclz-9953021-0 (rule
Win.Malware.Eclz-9953021-0) - engine signal, weight 0.90, confidence 0.95 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded domains
- u.ai
File paths
- C:\password.txt
- C:\debug.txt
More Eclz samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report