MALICIOUS — f363acfed72f350ca7eeecab6cda94d8051f324fd3966e558aa91f7747e34397

MALICIOUS — f363acfed72f350ca7eeecab6cda94d8051f324fd3966e558aa91f7747e34397 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100), attributed to the Psixbot family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: f363acfed72f350ca7eeecab6cda94d8051f324fd3966e558aa91f7747e34397
• SHA-1: afebc5b7f01a22ecf531c80fa7ff9586265feca6
• MD5: a2e097194328b55ab02d4a6fa88bd129
• imphash: 8fecd48a2a2309d9acd4f1e6ab7123d1
• ssdeep: 3072:tZTz1WIXC6GESSgWNRXumi7+IF6foPCaTRMXbaev0FQcmWk6kwsNIf6cHzbQ2v0:tZHcIX9SSgMi+IFZMbQrkodzb4VF2Yd
• TLSH: T19F477CCE4119779FDA379E113850AAAEA4A2F8C6D4B53F0C0A87C43A3191C1BED7145B
• Submitted as: f363acfed72f350ca7eeecab6cda94d8051f324fd3966e558aa91f7747e34397
• File type: pe · Size: 326792 bytes
• Verdict: malicious (95/100) · Family: Psixbot

Detections (6 of 55 engines)

• capa (capabilities): capability:execution/powershell
• ClamAV (daily): Win.Malware.Psixbot-9917128-0
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Microsoft Defender: Trojan:Win32/PsiXBot!pz
• Emsisoft (Emergency Kit): Adware.GenericKD.61115760
• Kaspersky (KVRT): HEUR:Backdoor.Win32.PsixBot.gen

MITRE ATT&CK

• T1059.001
• T1547.001

Why this verdict

The malicious score of 95/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Win.Malware.Psixbot-9917128-0 (rule Win.Malware.Psixbot-9917128-0) - engine signal, weight 0.90, confidence 0.95
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: http://checkip.dyndns.org/, http://rrradiusspace.bit/, http://spinner.bit/ - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://checkip.dyndns.org/
• http://rrradiusspace.bit/
• http://spinner.bit/
• http://getreserv.su/safedomain.txt

Embedded domains

• checkip.dyndns.org
• dns2.soprodns.ru
• dns1.soprodns.ru
• getreserv.su
• rrradiusspace.bit
• spinner.bit

Embedded IP addresses

• 5.154.191.67
• 185.121.177.177
• 169.239.202.202
• 198.251.90.143
• 111.67.20.8
• 163.53.248.170
• 139.59.17.152
• 142.4.204.111
• 142.4.205.47
• 158.69.239.167
• 192.99.85.244
• 31.3.135.232
• 31.171.251.118
• 81.2.241.148
• 62.113.203.99
• 37.58.63.27
• 130.255.78.223
• 144.76.133.38
• 82.141.39.32
• 139.59.208.246
• 172.104.136.243
• 130.255.73.90
• 195.154.226.249
• 212.47.242.157
• 87.98.175.85

File paths

• G:\WORK\MONEY\BOT\NoName\PsiX\obj\x86\Release\source2.pdb
• c:\users\user\source\repos\WindowsProject1\Release\WindowsProject1.pdb
• C:\Windows\Microsoft.NET\Framework\v4.0.30319
• C:\Program
• C:\Windows\SysWOW64\WindowsPowerShell
• C:\Windows\explorer.exe

More Psixbot samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report