MALICIOUS — Win32.SofacyCarberp.exe

MALICIOUS — Win32.SofacyCarberp.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Seduploader family. 5 of 51 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: ff808d0a12676bfac88fd26f955154f8884f2bb7c534b9936510fd6296c543e8
SHA-1: 8d6db316ea4e348021cb59cf3c6ec65c390f0497
MD5: 36524c90ca1fac2102e7653dfadb31b2
imphash: 7cfc69e858a62e1e5a68d5510338c173
ssdeep: 3072:t1k+GeIPLGjgSe8s0UWx5rJ1GI+qDVvDW3NjTTiP1ZWE:/GuDe8ZUaJxs3NnKZ
TLSH: T19D3D8D8C4616B345EA7786A06D501F1EE056F09EA3FD791C4E83C06F33A285BEA7045B
Submitted as: Win32.SofacyCarberp.exe
File type: pe · Size: 133632 bytes
Verdict: malicious (100/100) · Family: Seduploader

Detections (5 of 51 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
ClamAV (daily): {MD5}bin.dropper.seduploader.7331.UNOFFICIAL
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Sofacy
Emsisoft (Emergency Kit): Gen:Variant.Sednit.61

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged {MD5}bin.dropper.seduploader.7331.UNOFFICIAL (rule {MD5}bin.dropper.seduploader.7331.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Seduploader): 12e6642cf6413bdf5388bee663080fa299591b2ba023d069286f3be9647547c8 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Sofacy (rule Trojan:Win32/Sofacy) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Sednit.61 (rule Gen:Variant.Sednit.61) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Extracted Seduploader config (0 C2) - engine signal, weight 0.45, confidence 0.60
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

17549 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/5166/files/a4ea70c63987911599c37c1eae3e75c2e561ec231e4aa18b38b7922c00e6f087 - a4ea70c63987911599c37c1eae3e75c2e561ec231e4aa18b38b7922c00e6f087
12e6642cf6413bdf5388bee663080fa299591b2ba023d069286f3be9647547c8 - 12e6642cf6413bdf5388bee663080fa299591b2ba023d069286f3be9647547c8
3893263f00a05b965cc0e90c1dcd6d23b04adb86f8368afb674ff609c1455702 - 3893263f00a05b965cc0e90c1dcd6d23b04adb86f8368afb674ff609c1455702
675bc6a538e920d9c398b63d12fdbfb4883828c4ea53193a09fd1b0427cd3ee6 - 675bc6a538e920d9c398b63d12fdbfb4883828c4ea53193a09fd1b0427cd3ee6

Embedded domains

aefd.nelreports.net

File paths

T:\:d:l:t:
X:\:t:

More Seduploader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report