MALICIOUS — fca8705f0e9c825dbaf1d130ade2712bad4c9ecff4a149636b57c71711e14657

MALICIOUS — fca8705f0e9c825dbaf1d130ade2712bad4c9ecff4a149636b57c71711e14657 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Brontok family. 6 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: fca8705f0e9c825dbaf1d130ade2712bad4c9ecff4a149636b57c71711e14657
• SHA-1: 08a1fe66bb843fe5c2183086272639203fd48fbf
• MD5: 83af0ad656e2a6146be9f9c1abc4f536
• imphash: c81d603829cdee893f69bc47cb4f6e00
• ssdeep: 1536:5vbMoORizUPliPsm/gL16ZpQGh6MgHN+PhuLGR/11TvzRMoOJ:RbxOMUMPsgQvTMY+PhGGR/11TdxOJ
• TLSH: T1843A3A286075F702E7C6DC27A7358A4EA0416478E2F46ECA21C1C24F71F1F639C865EA
• Submitted as: fca8705f0e9c825dbaf1d130ade2712bad4c9ecff4a149636b57c71711e14657
• File type: pe · Size: 99999 bytes
• Verdict: malicious (97/100) · Family: Brontok

Detections (6 of 52 engines)

• capa (capabilities): capability:credential-access
• ClamAV (daily): Win.Worm.Brontok-9815928-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Kaspersky (KVRT): Email-Worm.Win32.Brontok.o
• Microsoft Defender: Worm:Win32/Brontok.BJ@mm
• Emsisoft (Emergency Kit): Win32.Worm.Brontok.AM

MITRE ATT&CK

• T1555
• T1003
• T1547.001
• T1071.001

Why this verdict

The malicious score of 97/100 is the fusion of 6 weighted signals:

• ClamAV (daily) flagged Win.Worm.Brontok-9815928-0 (rule Win.Worm.Brontok-9815928-0) - engine signal, weight 0.90, confidence 0.95
• Kaspersky (KVRT) flagged Email-Worm.Win32.Brontok.o (rule Email-Worm.Win32.Brontok.o) - engine signal, weight 0.55, confidence 0.85
• access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded domains

• services.com
• yesbron.com
• 15-bali.com
• k.com

File paths

• C:\Baca

More Brontok samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report