MALICIOUS — 603_Shamoon.bin

MALICIOUS — 603_Shamoon.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the DistTrack family. 6 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: f9d94c5de86aa170384f1e2e71d95ec373536899cb7985633d3ecfdb67af0f72
• SHA-1: 502920a97e01c2d022ac401601a311818f336542
• MD5: d214c717a357fe3a455610b197c390aa
• imphash: c813c542704a675537c80dbea4da705b
• ssdeep: 24576:XfzZdE5gNLKg98gJWLVFpafKo2Ebzm3q:LZdEEOg+fVRo2Ebzz
• TLSH: T165526B86034827EEDD3A66520419CA7DF195259A42FE0564CEFF384A0C423D7BE7CE4A
• Submitted as: 603_Shamoon.bin
• File type: pe · Size: 989184 bytes
• Verdict: malicious (100/100) · Family: DistTrack

Detections (6 of 52 engines)

• ClamAV (daily): Win.Trojan.DistTrack-1
• YARA: JPCERT/CC: JPCERT_Emotet
• Cyble Vision: Cyble Vision: Malicious
• Microsoft Defender: Trojan:Win32/WipMBR.A
• Emsisoft (Emergency Kit): Gen:Trojan.Heur.8u0@ILmUdSm
• Kaspersky (KVRT): Trojan.Win32.EraseMBR.a

MITRE ATT&CK

• T1057

Why this verdict

The malicious score of 100/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Win.Trojan.DistTrack-1 (rule Win.Trojan.DistTrack-1) - engine signal, weight 0.90, confidence 0.95
• Cyble Vision flagged Cyble Vision: Malicious (rule Cyble Vision: Malicious) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/WipMBR.A (rule Trojan:Win32/WipMBR.A) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Trojan.Heur.8u0@ILmUdSm (rule Gen:Trojan.Heur.8u0@ILmUdSm) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Trojan.Win32.EraseMBR.a (rule Trojan.Win32.EraseMBR.a) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded domains

• testdomain.com

File paths

• c:\windows\temp\out17626867.txt
• X:\:`:
• C:\Windows\system32\svchost.exe

More DistTrack samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report