MALICIOUS — ffeab71f78229456d0b381c5f9c11f6b01d21ae1b6e19656e26882840b7adc2a

MALICIOUS — ffeab71f78229456d0b381c5f9c11f6b01d21ae1b6e19656e26882840b7adc2a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100), attributed to the Container family. 4 of 29 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: ffeab71f78229456d0b381c5f9c11f6b01d21ae1b6e19656e26882840b7adc2a
SHA-1: 229b6024bce8f79638fd02df6f1756a36bfcc6eb
MD5: 8e6613cfd67d4582ae6dc251966ad68b
imphash: 8b1fc5c989964e6fc1675250748f63dc
ssdeep: 24576:A/POPmSrwCzEuAwj2fNuIhakf8I+sk81/g/J/JnDkl:JmSZzvKfNuIhakf8V8yDk
TLSH: T1D1564ADACB155B2BC2E2C61E664D544E10B22DF0506F3F5C48F2A1B689E60636F4E07B
Submitted as: ffeab71f78229456d0b381c5f9c11f6b01d21ae1b6e19656e26882840b7adc2a
File type: pe · Size: 1443328 bytes
Verdict: malicious (91/100) · Family: Container

Detections (4 of 29 engines)

capa (capabilities): capability:collection/keylog
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks

MITRE ATT&CK

Why this verdict

The malicious score of 91/100 is the fusion of 8 weighted signals:

Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 21 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/CSPCA.crt0
http://www.microsoft.com/pki/certs/tspca.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787884894&P2=404&P3=2&P4=PeE3FVVOsJ6MNb9SFx8ecMEXKsA1781idu%2bU2svaRdlH7XHIXwdH1Lf29E49ywceSqSsAhLwp2feMQDKRO3Zsg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com

Embedded IP addresses

20.184.175.6
52.253.84.76
40.84.97.4
4.230.171.124
74.178.240.61
135.232.92.97
4.207.44.71
40.99.134.18
52.123.128.14
20.112.250.133
52.123.129.14
162.159.142.9
20.42.73.31
203.26.79.13
135.233.45.221
52.123.252.195
72.153.5.134
74.178.232.29
52.148.114.188
52.110.12.55
52.110.12.21

File paths

f:\RedBits\Tools\devdiv\FinalPublicKey.snk
f:\dd\tools\devdiv\EcmaPublicKey.snk
C:\Loggers\MyLogger.dll;OutputAsHTML
f:\RedBits\tools\devdiv\FinalPublicKey.snk
f:\RedBits\vsproject\xmake\XMakeCommandLine\objr\i386\MSBuild.pdb
d:\sp1.public.x86fre\internal\strongnamekeys\fake\windows.snk
C:\Users\Vinay\Projects\simple_launcher\Release\CLISimpleLauncher.pdb
R:\:t:

More Container samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report