MALICIOUS — f98079c25350ec317dc2adec506043725202d735b3c20238547acf1e9b21f499
MALICIOUS — f98079c25350ec317dc2adec506043725202d735b3c20238547acf1e9b21f499 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Blocker family. 6 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.
Identification
- SHA-256:
f98079c25350ec317dc2adec506043725202d735b3c20238547acf1e9b21f499 - SHA-1:
4f96924e79f647a9769db84a90fbb013679a68f1 - MD5:
e5ec6f83a40c0a111bdc4eb28d1bde31 - imphash:
8d08b9aff260461badc1821f4f717247 - ssdeep:
196608:8dazg7DSmdazg7DSmgdazg7DSmdazg7DSmD:dg7ujg7u4g7ujg7ug - TLSH:
T1506A137E130B7403DE3AD62554862FCD0463BCAD507D5888553B84BE93F6CEB27806AA - Submitted as: f98079c25350ec317dc2adec506043725202d735b3c20238547acf1e9b21f499
- File type: pe · Size: 9338880 bytes
- Verdict: malicious (99/100) · Family: Blocker
Detections (6 of 52 engines)
- capa (capabilities): capability:collection/keylog
- ClamAV (daily): Win.Trojan.Mbrlock-9779766-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Trojan:Win32/Blocker.EM!MTB
- Emsisoft (Emergency Kit): Gen:Variant.Genie.689
- Kaspersky (KVRT): HEUR:Trojan.Win32.Agent.gen
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 9 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Mbrlock-9779766-0 (rule
Win.Trojan.Mbrlock-9779766-0) - engine signal, weight 0.90, confidence 0.95 - Dropped a suspicious payload (Container): f28f1b72cc586f89564086b7967f94318b37cfe69dd85f66bc2c5aadce21461f - dynamic signal, weight 0.50, confidence 0.90
- Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - Contacted 42 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1082, T1622, T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
44815 behavior events · 2 ATT&CK techniques · 18 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- sunray1975.zapto.org
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
- licensing.mp.microsoft.com
- www.bing.com
- msedge.api.cdp.microsoft.com
- tas02.sls.update.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/12591/files/7cb06f8dbfa5f13359e2dcee822fae73ef01a00ff29ce99ec401a73017875aee -
7cb06f8dbfa5f13359e2dcee822fae73ef01a00ff29ce99ec401a73017875aee - /opt/CAPEv2/storage/analyses/12591/files/f28f1b72cc586f89564086b7967f94318b37cfe69dd85f66bc2c5aadce21461f -
f28f1b72cc586f89564086b7967f94318b37cfe69dd85f66bc2c5aadce21461f - /opt/CAPEv2/storage/analyses/12591/files/08044cb0c4a917973851956ea8c8924bf902ad8eee2c44b1c479e170c5be4594 -
08044cb0c4a917973851956ea8c8924bf902ad8eee2c44b1c479e170c5be4594 - /opt/CAPEv2/storage/analyses/12591/files/8c91429e1a1c00dff49152f8b1cb71e409349ecb811d33383753768c3c1083ac -
8c91429e1a1c00dff49152f8b1cb71e409349ecb811d33383753768c3c1083ac - /opt/CAPEv2/storage/analyses/12591/files/25c9d0459cb9768a5b9261f21bb892ca4e3d4c02e9374bbdf6b4980d6af4d6f8 -
25c9d0459cb9768a5b9261f21bb892ca4e3d4c02e9374bbdf6b4980d6af4d6f8 - /opt/CAPEv2/storage/analyses/12591/files/d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9 -
d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9 - /opt/CAPEv2/storage/analyses/12591/files/fcd785d06efc594628f2460b3098d5b97633f2e4587be0fa50dd8cd60a447407 -
fcd785d06efc594628f2460b3098d5b97633f2e4587be0fa50dd8cd60a447407 - /opt/CAPEv2/storage/analyses/12591/files/0dc9e64e2b9e237739a6d816d97177119857a547689e610a2087e165833e1d46 -
0dc9e64e2b9e237739a6d816d97177119857a547689e610a2087e165833e1d46 - /opt/CAPEv2/storage/analyses/12591/files/aef3ddd61208d3f5fab632430165bf5d27ac34be3ee9b49e987ad15fd5555ead -
aef3ddd61208d3f5fab632430165bf5d27ac34be3ee9b49e987ad15fd5555ead - /opt/CAPEv2/storage/analyses/12591/files/a66b013f22055a8295b1e840c14d6403234cc5c904ca90d2f24c6d774cdfcd1f -
a66b013f22055a8295b1e840c14d6403234cc5c904ca90d2f24c6d774cdfcd1f - /opt/CAPEv2/storage/analyses/12591/files/bde0e157f656f6debbe15d90009251b682ce8d9eafa8b7ea3f1d5f878c5b39bd -
bde0e157f656f6debbe15d90009251b682ce8d9eafa8b7ea3f1d5f878c5b39bd - /opt/CAPEv2/storage/analyses/12591/files/b0715c24eef4c3d20c812bb858a4e50569a836f0217c7652fb350be953e5f50d -
b0715c24eef4c3d20c812bb858a4e50569a836f0217c7652fb350be953e5f50d - /opt/CAPEv2/storage/analyses/12591/files/ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420 -
ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420 - /opt/CAPEv2/storage/analyses/12591/files/09e985221b7fb3838f29511024c70f6b1511efe969b07e369ef6d79149121883 -
09e985221b7fb3838f29511024c70f6b1511efe969b07e369ef6d79149121883 - /opt/CAPEv2/storage/analyses/12591/files/6b22058a942c7258dbc92bd18924101717e82a02cb6d581b12a095d1e78f62cd -
6b22058a942c7258dbc92bd18924101717e82a02cb6d581b12a095d1e78f62cd
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786526428&P2=404&P3=2&P4=Y9e4ZQ1oC4uQkdqjfR2GqSgTsJQQJKj%2bYVWkP5z%2f1haOh%2f%2f0BqrJeMIcbYwWboz5TU3UPMdACkki5wqKUR8mQA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786526460&P2=404&P3=2&P4=nTpsFm9ufkRer4wB5Dw4PyqeSo6XzX49oxOrhfYxUFQf6e3l7DmET%2bN6v2YuY8NVz3zN%2foJQlsMW6PW6%2b2YBdA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- hb.za
- sunray1975.zapto.org
Embedded IP addresses
- 52.178.17.2
- 4.230.171.124
- 20.42.179.204
- 20.247.184.142
- 135.233.95.144
- 135.233.95.135
- 52.168.117.175
- 57.155.104.224
- 4.144.132.223
- 203.26.79.13
- 4.144.132.114
- 135.233.45.222
- 52.123.252.244
- 135.233.95.80
- 4.150.223.103
- 20.42.65.89
- 172.178.240.161
- 172.178.240.163
- 72.145.35.112
- 48.192.143.121
- 4.150.223.106
- 52.168.117.168
- 52.148.114.188
- 52.110.12.32
- 52.110.12.26
File paths
- B:\:t:
- X:\:`:d:h:l:p:t:
- X:\:`:d:h:l:p:t:x:
- J:\:`:d:h:
- I:\ba
More Blocker samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report