MALICIOUS — f1d248ba2f33a11790905f93028f06f6ac6dc0dcdddbb7c0737f4e659aae95de

MALICIOUS — f1d248ba2f33a11790905f93028f06f6ac6dc0dcdddbb7c0737f4e659aae95de is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Crypted family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: f1d248ba2f33a11790905f93028f06f6ac6dc0dcdddbb7c0737f4e659aae95de
SHA-1: b67fac949f1556a2490f7b438b22b09b863258d1
MD5: e5007c1c26788eeda20b90c01bd61686
imphash: 26babd76bbb7f9c516a338b0601b4c9f
ssdeep: 1536:uC+LtFlA+4FnenuBoBmVvsdlAqJD8Xh6+7:udFlkpevwvKAzXA+
TLSH: T1CA388D1058A989EDFE5551CE4385112DE320310D7DA7A2D7A364AFC627E408F88DBFAC
Submitted as: f1d248ba2f33a11790905f93028f06f6ac6dc0dcdddbb7c0737f4e659aae95de
File type: pe · Size: 77824 bytes
Verdict: malicious (99/100) · Family: Crypted

Detections (4 of 56 engines)

ClamAV (daily): Win.Trojan.Crypted-30
Microsoft Defender: Backdoor:Win32/Padodor.SK!MTB
Emsisoft (Emergency Kit): Trojan.Peed.Gen
Kaspersky (KVRT): Backdoor.Win32.Padodor.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Trojan.Crypted-30 (rule Win.Trojan.Crypted-30) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Backdoor:Win32/Padodor.SK!MTB (rule Backdoor:Win32/Padodor.SK!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Peed.Gen (rule Trojan.Peed.Gen) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Padodor.gen (rule Backdoor.Win32.Padodor.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Dropped 118 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

3724 behavior events · 1 ATT&CK techniques · 118 dropped files.

Dropped files

C:\Windows\System32\Hhendh32.exe - 0482efedfed3732a6e4e5d594e29781fb6eef915de57eb994cc2fcf78b17907e
C:\Windows\System32\Mcqffpjd.dll - de3c2a46bad9b137a72514830e31794943bc0fbc6749ac8a8e33e26dab45d0e9
C:\Windows\System32\Igdjdn32.exe - 98c745c5c29896de05ff198299fdc037b0447331196f07e93d29cb26f80a818c
C:\Windows\System32\Pggaff32.exe - 83dd6830ddac2b460fdbb7554a2fdb48780fc30d29640d3258362c675ab67bc4
C:\Windows\System32\Oajmmqde.dll - b3c0ccf30da11504c476424c69ece0635f7f86a9c966d58bf2b99dd816f16e12
C:\Windows\System32\Mkblha32.dll - 909654e3972f273aa56c18abde2794bdf8a135f0e20405f43586a5daf8c15fda
C:\Windows\System32\Lapphc32.dll - 40e1993dfdf22d56d1e56be053103bac3bb175dc446e1b7097161fa0738a4936
C:\Windows\System32\Qhlglh32.exe - 2c36a2cb6ed6c6ca551fcefb3491cfcc64b1b37693d152716061d55816380d4e
C:\Windows\System32\Jjhgeo32.exe - a7d0b0b297c526699ec949f4000625450ce837463df1a13c474c5af4cc211b7e
C:\Windows\System32\Fgjpecga.dll - d07c169e23eec07eeb8f42cd471bf842bdd7124f0b49e989e49d564acb048466
C:\Windows\System32\Bjankokl.dll - 490748f9752f6ee82a09dca87ce7b928bca34db4bbc467cbd57dc03c641c4552
C:\Windows\System32\Bgcjibeo.exe - 360184bdacdb7e015c042723074d47a68bab6486989454c922a28590b07c3384
C:\Windows\System32\Cbdoaf32.exe - db6f7c7b5e6779b15f9ad62521eef420930ad7ec217bb461bbf55d4cf3d32cb8
C:\Windows\System32\Gqkmniih.dll - 0410cfcab92a9ddd08277b738b94fbf3a73a9908a4d7a6c42f362114c15ae4cf
C:\Windows\System32\Lniehkmn.exe - 237d8be498d2149b3aa1cdebd0e30c9fe3e6db00c88359ed16f8743de589b46b

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

vz.za
z.za

Embedded IP addresses

4.150.223.99
20.3.0.251
4.230.171.124
104.18.33.89
57.155.104.224
74.178.76.54
4.150.223.114
74.179.77.204
40.84.85.40
72.145.35.104
135.233.45.221
52.148.114.188
52.110.12.50
52.110.12.4

More Crypted samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report