MALICIOUS — Win32.MyLobot.bin
MALICIOUS — Win32.MyLobot.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the CeeInject family. 6 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
f4ba5e8f98fe70d764df71b7c390237b90ed0fc3408579a15a06ee56008a3531 - SHA-1:
2a6b0f3a422a49e450cc39354fd687084c8a209e - MD5:
c5307c17eeda787432f82f1d648a368c - imphash:
d8691188c285d2cf8265c0e15c738ffb - ssdeep:
3072:Df5M0zA8NTyQXMyVAyzPt+irbu5xYWLFQ3aC6ulgkNS82avsM:3AgeQcaJrFWxm6ulgWS82ZM - TLSH:
T11A40F191463EC783DEE25B2198C24D1E349390FFA4BE590A3BD7E56D57E2CD7A420028 - Submitted as: Win32.MyLobot.bin
- File type: pe · Size: 180224 bytes
- Verdict: malicious (98/100) · Family: CeeInject
Detections (6 of 51 engines)
- MalwareAnalyser heuristics (entropy/packer): Microsoft Visual C/C++
- ClamAV (daily): Win.Trojan.Agent-6584633-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Detect It Easy (packer/type): DIE:Microsoft Visual C/C++
- Microsoft Defender: VirTool:Win32/CeeInject.ANO!bit
- Emsisoft (Emergency Kit): Trojan.Agent
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Agent-6584633-0 (rule
Win.Trojan.Agent-6584633-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged VirTool:Win32/CeeInject.ANO!bit (rule
VirTool:Win32/CeeInject.ANO!bit) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Agent (rule
Trojan.Agent) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:Microsoft Visual C/C++ (rule
DIE:Microsoft Visual C/C++) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: Microsoft Visual C/C++ - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
102 behavior events · 1 ATT&CK techniques · 2 dropped files.
Runtime network
- searchapp.bundleassets.example
- www.msftconnecttest.com
- www.bing.com
- config.edge.skype.com
- desktop-hsgcbep
- aefd.nelreports.net
- watson.events.data.microsoft.com
- dns.msftncsi.com
- g.live.com
- self.events.data.microsoft.com
- 192.168.122.106
- 192.168.122.1
- 192.168.122.255
- 224.0.0.252
- 192.168.122.107
- 192.168.122.108
- 192.168.122.111
- 192.168.122.105
- 224.0.0.22
Dropped files
- 1bef155c2e4a0cf4785a80388da30562ac9b55fa33e63e7982b5f6c3478195e8 -
1bef155c2e4a0cf4785a80388da30562ac9b55fa33e63e7982b5f6c3478195e8 - 9403564bd75f29af677e9ebbe5a51c2cce0460c13c8d04d8aecb88d537bb2a32 -
9403564bd75f29af677e9ebbe5a51c2cce0460c13c8d04d8aecb88d537bb2a32
Embedded domains
- aefd.nelreports.net
More CeeInject samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report