MALICIOUS — f53693e9871d74c13b61a15b09b430855dde705fa42f4a8b56fbf82bcd151f15

MALICIOUS — f53693e9871d74c13b61a15b09b430855dde705fa42f4a8b56fbf82bcd151f15 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100), attributed to the Bobik family. 2 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: f53693e9871d74c13b61a15b09b430855dde705fa42f4a8b56fbf82bcd151f15
• SHA-1: 2e10967297606c01d8eb04393bf6a7cd0f49cad2
• MD5: 8e66ab7a5fc09f6224afc506ede39f08
• imphash: f34d5f2d4577ed6d9ceec516c1f5a744
• ssdeep: 3072:M2iGVkUOrAnht9fav5nUJ/F9Mn+GYloAcBN8Zihsc/L319C9HpJXN2Bq25mRlz+:biGtSAQUJ9KZi4gIsc/b69HHXN/9x
• TLSH: T18146C0C556263E11CC72EA033949ECAD7D599842F8BD6D9C67068E22752CF7F803312A
• Submitted as: f53693e9871d74c13b61a15b09b430855dde705fa42f4a8b56fbf82bcd151f15
• File type: pe · Size: 293888 bytes
• Verdict: malicious (87/100) · Family: Bobik

Detections (2 of 56 engines)

• capa (capabilities): capability:execution/powershell
• Microsoft Defender: Trojan:MSIL/Bobik.PTFJ!MTB

MITRE ATT&CK

• T1059.001
• T1056.001
• T1112

Why this verdict

The malicious score of 87/100 is the fusion of 8 weighted signals:

• Microsoft Defender flagged Trojan:MSIL/Bobik.PTFJ!MTB (rule Trojan:MSIL/Bobik.PTFJ!MTB) - engine signal, weight 0.55, confidence 0.85
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• Contacted 33 external host(s) and 9 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

25182 behavior events · 1 ATT&CK techniques · 2 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• tas02.sls.update.microsoft.com
• settings-win.data.microsoft.com
• 76.0.240.10.in-addr.arpa.
• 163.142.190.20.in-addr.arpa.
• v10.events.data.microsoft.com
• 1.0.240.10.in-addr.arpa.
• 11.175.184.20.in-addr.arpa.
• 144.95.233.135.in-addr.arpa.
• d.1.d.1.c.4.2.1.4.9.5.2.6.e.8.b.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa.
• 224.188.247.4.in-addr.arpa.
• 251.0.0.224.in-addr.arpa.
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• watson.events.data.microsoft.com

Dropped files

• 4747041be8bad05ac4827d035c048ef41405d871f64c848f22d525f536d6a6be - 4747041be8bad05ac4827d035c048ef41405d871f64c848f22d525f536d6a6be
• c985a296b8bf284fa5a129ee956117aecabdd161014919ae7730c68833fd0a5f - c985a296b8bf284fa5a129ee956117aecabdd161014919ae7730c68833fd0a5f

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• _ldap._tcp.dc._msdcs.workgroup
• _vlmcs._tcp

Embedded IP addresses

• 172.172.255.217
• 57.155.101.212
• 172.215.188.232
• 40.84.97.4
• 52.168.117.175
• 20.42.73.24
• 4.247.188.224
• 20.42.65.90
• 74.178.76.44
• 4.247.188.233
• 20.184.175.11
• 85.210.196.11
• 135.234.160.246
• 135.233.95.144
• 20.42.179.192
• 48.211.4.16
• 57.155.104.224
• 52.123.252.215
• 52.148.114.188
• 172.215.188.225
• 74.178.240.61
• 57.154.63.210
• 72.153.5.138
• 92.223.78.30
• 20.42.65.84

More Bobik samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report