MALICIOUS — f4dc4093baa6cdb4659d46b901f762245809992bc700ac57a9035c1618306909

MALICIOUS — f4dc4093baa6cdb4659d46b901f762245809992bc700ac57a9035c1618306909 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Simda family. 7 of 56 detection engines flagged it, exhibiting 8 ATT&CK techniques.

Identification

SHA-256: f4dc4093baa6cdb4659d46b901f762245809992bc700ac57a9035c1618306909
SHA-1: 59da0d60d82dd7c22678ebb6c69f1f4f69f76c54
MD5: 4fae944f864eac32573dc22830b64fa1
imphash: e4284c77d0ddfc22d080aac379d5f31d
ssdeep: 12288:iwmWTR1arYnEKosuzY34CZ3DQvSkNL9qyFhJy56d/eoyXjn9W:iwmyRcrYnxUzY3NZ3DQvZNL9X7Zyz9W
TLSH: T1064DBE4FAA06A788E0A5C74054C05C9C8177A6ED92BB284C5987C47E77F8CEB70F528D
Submitted as: f4dc4093baa6cdb4659d46b901f762245809992bc700ac57a9035c1618306909
File type: pe · Size: 614400 bytes
Verdict: malicious (100/100) · Family: Simda

Detections (7 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Shiz-9949267-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
Microsoft Defender: Backdoor:Win32/Simda!pz
Emsisoft (Emergency Kit): Backdoor.Simda.A
Kaspersky (KVRT): UDS:Backdoor.Win32.Generic

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 20 weighted signals:

ClamAV (daily) flagged Win.Trojan.Shiz-9949267-0 (rule Win.Trojan.Shiz-9949267-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Backdoor:Win32/Simda!pz (rule Backdoor:Win32/Simda!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Backdoor.Simda.A (rule Backdoor.Simda.A) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Backdoor.Win32.Generic (rule UDS:Backdoor.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
2 behavioral detection(s) across 2 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.43, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 19 external host(s) and 62 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
Extracted Simda config (0 C2) - engine signal, weight 0.45, confidence 0.60
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.30, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 5632) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

477 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Windows\apppatch\svchost.exe - fe2e6e4886000aeec71637361fa2148599cd591c718d4d92325c6f542cb3ac78
c9755626dc83b13f603a7add12ae1e9e3970354b44c707f4ffab459f19ef7315 - c9755626dc83b13f603a7add12ae1e9e3970354b44c707f4ffab459f19ef7315

Embedded URLs

http://www.google.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://qegyhig.com/login.php
http://gahyqah.com/login.php
http://lysyfyj.com/login.php
http://qetyfuv.com/login.php
http://gadyniw.com/login.php
http://lyvyxor.com/login.php
http://vocyzit.com/login.php
http://galyqaz.com/login.php
http://c.pki.goog/r/gsr1.crl
http://lymyxid.com/login.php
http://c.pki.goog/r/r4.crl
http://vonypom.com/login.php
http://c.pki.goog/we1/-hiVeOStiWo.crl
http://www.gahyqah.com/login.php
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://ye2.c.lencr.org/70.crl
http://ye2.c.lencr.org/64.crl
http://lyrysor.com/login.php
http://lysyvan.com/login.php
http://c.pki.goog/we1/hxWfeVec_R4.crl

Embedded domains

avast.com
eset.com
z-oleg.com
comodo.com
www.google.com
www.bing.com
www.microsoft.com
letitbit.net
ebank.laiki.com
w.qiwi.ru
login.yota.ru
mavast.com
qedyfyq.com
vonyzuf.com
pumyxiv.com
gatyfus.com
lyxywer.com
gahyhob.com
volyqat.com
qexyryl.com
gahyqah.com
qegyhig.com
lysyfyj.com
lyxylux.com
gadyfuh.com

Embedded IP addresses

20.89.1.12
4.149.227.78
52.123.252.223
4.230.171.124
172.64.154.167
20.165.94.54
20.42.179.192
74.178.76.128
4.150.223.98
104.247.81.99
3.229.117.57
54.85.87.184
34.229.166.50
2.59.170.19
199.191.50.83
103.224.182.213
103.224.182.252
212.32.255.111
208.91.196.145
52.27.79.221
172.67.182.219
135.233.45.221
104.21.26.151
104.21.30.183
104.18.20.213

File paths

I:\:d:s:z:

More Simda samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report