MALICIOUS — f9ff88edff0eb63054c242d43d0fde22d311fcda40efbc60b945cf8524b62d9c

MALICIOUS — f9ff88edff0eb63054c242d43d0fde22d311fcda40efbc60b945cf8524b62d9c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 5 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: f9ff88edff0eb63054c242d43d0fde22d311fcda40efbc60b945cf8524b62d9c
SHA-1: 65af3d8e17fc980fac0b74560a26656eee4d47a1
MD5: 3547ae4495906b7e798b0766865d231a
imphash: d96606024a9ef84869c5d61c686ef019
ssdeep: 384:IL1d8xSrN1g7xKudNdtADaM4E7FBoUOc:Igx+WxKuMDaMpZiUn
TLSH: T1E5315BDD8230264BCBE515246D23D98CD1A761E9505CB9AFCB9BC93D0CC18777836923
Submitted as: f9ff88edff0eb63054c242d43d0fde22d311fcda40efbc60b945cf8524b62d9c
File type: pe · Size: 40372 bytes
Verdict: malicious (98/100)

Detections (5 of 55 engines)

ClamAV (daily): Win.Trojan.Generic-9908807-0
Microsoft Defender: Trojan:Win32/Zegost.PEF!MTB
Emsisoft (Emergency Kit): Gen:Variant.Jaik.26278
Trellix Stinger (McAfee): PWSZbot-FEV!3547AE449590
Kaspersky (KVRT): HEUR:Trojan-Downloader.Win32.Upatre.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9908807-0 (rule Win.Trojan.Generic-9908807-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

44325 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\hcbnaf.exe - 151727e3432a55d66a6a46373ed9967613ef9cddfe9b4af12b5620b9b35638de
da5d6e5526bc89280432d65c00c69cf2d1a1773bd08f8df0aded4c981289fabe - da5d6e5526bc89280432d65c00c69cf2d1a1773bd08f8df0aded4c981289fabe

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787878890&P2=404&P3=2&P4=SA63Gf%2fgv9meRpZCuhldUal3%2bTL%2fmAGMr9%2fob0l%2fzWLmRzOUIc3aJGP0XdW3uRO8d9P8FIdpmiD8RpDSHOa1tw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787879001&P2=404&P3=2&P4=i3NZkSGXjODnq9apPLEOC6xsGGGzBxBEgtIR1iC4HLOfgsq5Vfe16Z1nq7PHKDGWuylaTLhrnx9eGR1IbOLJwQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

thisisyourwife.co.uk

Embedded IP addresses

4.207.44.64
40.84.85.40
4.230.171.124
52.253.84.76
48.211.4.16
74.178.76.128
74.179.77.164
20.42.73.30
20.236.44.162
40.99.133.210
40.99.133.226
52.123.128.14
52.123.129.14
40.79.150.121
135.234.160.244
52.123.252.212
135.234.160.246
52.110.12.37
203.26.79.13
52.110.12.25
52.148.114.188
52.123.252.246
135.232.92.34
52.123.252.230
52.168.117.175

File paths

C:\kiuadlgn\cyschuj.exe
C:\Users\admin\Downloads\f74a2798b68dd87f3f606b391e2bcb40.virus.exe
C:\Users\admin\Downloads\a7a10fc356301db2366f771b793db9b5a1436051af5f9320d53186651115f0b3.exe
C:\Users\Frank\Desktop\nSdMSFLd.exe
C:\Users\admin\Downloads\fb1f1f0633cdc9fd9fba315c564cc4c4679ae491f8f8d2a47045bb500a6fd9bc.exe
C:\Users\george\Desktop\hcbnaf.exe
C:\Users\admin\Downloads\hcbnaf.exe
C:\3afad138a778aa1e4f2af9ad8b7db827fe71106fa0ba92a753293a49d0a409c1
C:\czzEaACJ.exe
C:\Users\george\Desktop\executable.exe

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report