MALICIOUS — fa8b85ee420225d7b5eb38340e9cd9622c632465dc8e12c8601cd55c55e485c2

MALICIOUS — fa8b85ee420225d7b5eb38340e9cd9622c632465dc8e12c8601cd55c55e485c2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Philis family. 7 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: fa8b85ee420225d7b5eb38340e9cd9622c632465dc8e12c8601cd55c55e485c2
SHA-1: 9a516a2e2bd29807092a0fb26686f2a727ab672f
MD5: 7b8bafcf18e16184e5ac869ca92d0874
imphash: 87bed5a7cba00c7e1f4015f1bdae2183
ssdeep: 768:/bi16GVRu1yK9fMnJG2V9dDClcxzLzMcYpBeo6z597kDHEQ/OvS64Zl9Y7Ay:Tk3SHuJV9QaxzLzM916t9MHEQ/ZP9q
TLSH: T17937AFEAA37B2302D1BAB92074365CDC744334A662B76DCDE302C16A51F4E3794B52C6
Submitted as: fa8b85ee420225d7b5eb38340e9cd9622c632465dc8e12c8601cd55c55e485c2
File type: pe · Size: 76459 bytes
Verdict: malicious (100/100) · Family: Philis

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Borland Delphi
ClamAV (daily): Win.Trojan.Philis-2
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Borland Delphi
Microsoft Defender: Virus:Win32/Viking
Emsisoft (Emergency Kit): Generic.Viking.AD568429
Kaspersky (KVRT): Worm.Win32.Viking.n

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Trojan.Philis-2 (rule Win.Trojan.Philis-2) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Viking (rule Virus:Win32/Viking) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Generic.Viking.AD568429 (rule Generic.Viking.AD568429) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.Viking.n (rule Worm.Win32.Viking.n) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
2 behavioral detection(s) across 2 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.43, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Borland Delphi (rule DIE:Borland Delphi) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Borland Delphi (rule Borland Delphi) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Borland Delphi - static signal, weight 0.25, confidence 0.55
Dropped 5 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

45906 behavior events · 2 ATT&CK techniques · 9 dropped files.

Dropped files

bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\PerfLogs\_desktop.ini - fb408e5fa0ab18d1eb2e68798f51b7e97cab3dd592fe12830d5e40b56c131991
C:\Windows\vDll.dll - c7ab2ef9f1a85d624d24438bcb1f329a935e20a55ab9718c8ec8b93c86c159c4
C:\Users\analyst\AppData\Local\Temp\tsk_44c8ae431a3142e1.exe.exe - 8e902056a681e1ebd8a7659274da3ca8ae958c6de9b55cc21b13f2331acabf18
C:\Users\analyst\AppData\Local\Temp\$$a16CF.bat - 4221799d6db9752dd67e211068183b4e172cbf0510562ff515f5c7f247e607f6
C:\Windows\Logo1_.exe - be064da504400055aa19c6e0cfc5b790682a52a332dcd3aeaaf3c0421b1c2e26
C:\Sysmon64.exe - e50530fb0f252d4b6f50d9bea3938eaa8f195858c01a25c543652605fb6414f7
1c28bfa639cd01473e1672b18a411e0128172344836a6a67658f5085787efb70 - 1c28bfa639cd01473e1672b18a411e0128172344836a6a67658f5085787efb70
9b1bc0d9b55f579debc7b4f89674ce708a4689d856891445098563254c657537 - 9b1bc0d9b55f579debc7b4f89674ce708a4689d856891445098563254c657537

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.microsoft.com
www.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.96
52.123.252.198
4.230.171.124
85.210.196.11
4.247.188.224
74.178.76.54
52.230.60.54
51.116.246.104
74.178.240.61
4.150.223.111
104.18.33.89
74.179.77.204
104.208.16.94
52.168.117.168
57.155.104.224
135.233.45.223
52.148.114.188
72.154.7.110
52.110.12.48
52.110.12.14

More Philis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report