MALICIOUS — f22526efe6efd9761638f109749bdd1edc78d75ae9d7d0a0d2cfbc16ed602ac8

MALICIOUS — f22526efe6efd9761638f109749bdd1edc78d75ae9d7d0a0d2cfbc16ed602ac8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Shiz family. 7 of 56 detection engines flagged it, exhibiting 8 ATT&CK techniques.

Identification

SHA-256: f22526efe6efd9761638f109749bdd1edc78d75ae9d7d0a0d2cfbc16ed602ac8
SHA-1: ddf4e54febb9912c29a719385a454a5bb322e321
MD5: 9fc87892609cf8f543a511bc939998b3
imphash: e4284c77d0ddfc22d080aac379d5f31d
ssdeep: 12288:KwmWTR1arYnEKosuzY34CZ3DQvSkNL9qyFhJy56d/eoyXjn9W:KwmyRcrYnxUzY3NZ3DQvZNL9X7Zyz9W
TLSH: T12F4DBE4FAA06A788E0A5C74054C05C9C8177A6ED92BB284C5987C47E77F8CEB70F528D
Submitted as: f22526efe6efd9761638f109749bdd1edc78d75ae9d7d0a0d2cfbc16ed602ac8
File type: pe · Size: 614400 bytes
Verdict: malicious (100/100) · Family: Shiz

Detections (7 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Shiz-9949267-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
Microsoft Defender: Backdoor:Win32/Simda!pz
Emsisoft (Emergency Kit): Backdoor.Simda.A
Kaspersky (KVRT): UDS:Backdoor.Win32.Generic

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 19 weighted signals:

ClamAV (daily) flagged Win.Trojan.Shiz-9949267-0 (rule Win.Trojan.Shiz-9949267-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Backdoor:Win32/Simda!pz (rule Backdoor:Win32/Simda!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Backdoor.Simda.A (rule Backdoor.Simda.A) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Backdoor.Win32.Generic (rule UDS:Backdoor.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
2 behavioral detection(s) across 2 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.43, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 20 external host(s) and 65 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
Extracted Simda config (0 C2) - engine signal, weight 0.45, confidence 0.60
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.30, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis (windows)

470 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Windows\apppatch\svchost.exe - d78a23ebfc662f79d6d01ecd1c069c21658d8bdef26553be77c3b4b764596ce1
c9755626dc83b13f603a7add12ae1e9e3970354b44c707f4ffab459f19ef7315 - c9755626dc83b13f603a7add12ae1e9e3970354b44c707f4ffab459f19ef7315

Embedded URLs

http://www.google.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://gadyniw.com/login.php
http://gahyqah.com/login.php
http://qegyhig.com/login.php
http://qetyfuv.com/login.php
http://www.gahyqah.com/login.php
http://lyvyxor.com/login.php
http://galyqaz.com/login.php
http://lysyfyj.com/login.php
http://lymyxid.com/login.php
http://vocyzit.com/login.php
http://c.pki.goog/r/gsr1.crl
http://vonypom.com/login.php
http://c.pki.goog/r/r4.crl
http://x2.c.lencr.org/
http://c.pki.goog/we1/-hiVeOStiWo.crl
http://ye.c.lencr.org/
http://ye2.c.lencr.org/70.crl
http://ww9.galyqaz.com/
http://ye2.c.lencr.org/64.crl
http://lysyvan.com/login.php
http://c.pki.goog/we1/Hk21MYmfQqY.crl

Embedded domains

avast.com
eset.com
z-oleg.com
comodo.com
www.google.com
www.bing.com
www.microsoft.com
letitbit.net
ebank.laiki.com
w.qiwi.ru
login.yota.ru
mavast.com
gadyniw.com
qexylup.com
puzylyp.com
lymysan.com
vofymik.com
qeqysag.com
gatyfus.com
galykes.com
lyvytuj.com
gatyvyz.com
pujyjav.com
qebytiq.com
vopybyt.com

Embedded IP addresses

13.89.179.12
4.230.171.124
40.84.85.40
20.247.185.124
74.179.77.204
135.232.92.97
4.150.223.100
135.232.92.137
20.42.73.28
3.229.117.57
2.59.170.19
104.247.81.99
54.85.87.184
34.229.166.50
103.224.182.213
103.224.182.252
23.82.16.53
185.53.179.200
52.27.79.221
172.67.182.219
23.239.4.93
162.255.119.102
172.67.136.136
52.110.12.4
52.110.12.3

File paths

I:\:d:s:z:

More Shiz samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report