MALICIOUS — a83532d8494537d8facd84bc64a84b98d92020aae05e681d3b18459c5e12cc7c

MALICIOUS — a83532d8494537d8facd84bc64a84b98d92020aae05e681d3b18459c5e12cc7c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Viking family. 7 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

• SHA-256: a83532d8494537d8facd84bc64a84b98d92020aae05e681d3b18459c5e12cc7c
• SHA-1: 3828a77be54cab90141dc512f7a6afd505098f19
• MD5: 46ef2cc50e59593917da4d0e67d7ec1b
• imphash: 231425377893abb7b2ff9764e70528f2
• ssdeep: 6144:U8xmKdUjgOo8IRCSV5ITivRuWJy07i413:UWmKUjNo8IdaOASW4R
• TLSH: T1E4495C96C39A361FD7F2C80E4914C4BC8821B9ED60B4B1EA5381CA5E50EAC37D45936F
• Submitted as: a83532d8494537d8facd84bc64a84b98d92020aae05e681d3b18459c5e12cc7c
• File type: pe · Size: 403814 bytes
• Verdict: malicious (100/100) · Family: Viking

Detections (7 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:CODE
• ClamAV (daily): Win.Trojan.Philis-61
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Microsoft Defender: Trojan:Win32/Sabsik!rfn
• Emsisoft (Emergency Kit): GenPack:Win32.Worm.Viking.EO
• Kaspersky (KVRT): Worm.Win32.Viking.eo

MITRE ATT&CK

• T1071.001
• T1112
• T1082
• T1016
• T1033

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Philis-61 (rule Win.Trojan.Philis-61) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/Sabsik!rfn (rule Trojan:Win32/Sabsik!rfn) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged GenPack:Win32.Worm.Viking.EO (rule GenPack:Win32.Worm.Viking.EO) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Worm.Win32.Viking.eo (rule Worm.Win32.Viking.eo) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• Contacted 33 external host(s) and 9 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:CODE (rule high-entropy-sections:CODE) - engine signal, weight 0.35, confidence 0.70
• 1 behavioral detection(s) across 1 rule(s): System / Network Discovery burst [low] (rule tl-discovery-recon) - dynamic signal, weight 0.20, confidence 0.90
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-sections:CODE - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

22007 behavior events · 1 ATT&CK techniques · 2 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• 76.0.240.10.in-addr.arpa.
• 1.0.240.10.in-addr.arpa.
• 251.0.0.224.in-addr.arpa.
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• tas02.sls.update.microsoft.com
• 64.167.190.20.in-addr.arpa.
• v10.events.data.microsoft.com
• DESKTOP-HSGCBEP
• 61.240.178.74.in-addr.arpa.
• 71.44.207.4.in-addr.arpa.
• nexusrules.officeapps.live.com
• ecs.office.com
• desktop-hsgcbep

Dropped files

• 3e12dea988228f2a034c5b44008da74c2f5c2faa5488d1878d33112afee0e7b5 - 3e12dea988228f2a034c5b44008da74c2f5c2faa5488d1878d33112afee0e7b5
• a946ce2e5a8171b072e352efedc1c1edeba7a5123e6c0dccfe763e066c535b23 - a946ce2e5a8171b072e352efedc1c1edeba7a5123e6c0dccfe763e066c535b23

Embedded URLs

• http://schemas.microsoft.com/windows/2004/02/mit/task
• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• http://www.microsoft.com/windows0
• http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• schemas.microsoft.com
• www.microsoft.com
• crl.microsoft.com
• settings-win.data.microsoft.com
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 4.247.188.224
• 52.123.128.14
• 4.150.223.111
• 85.210.193.152
• 92.223.78.30
• 51.116.253.168
• 104.208.16.94
• 172.215.188.225
• 74.178.240.61
• 20.184.175.20
• 172.172.255.218
• 4.207.44.71
• 20.42.179.204
• 20.42.65.90
• 20.42.179.192
• 4.150.223.115
• 57.154.63.210
• 74.179.77.204
• 52.168.117.170
• 52.148.114.188
• 172.178.240.161
• 52.138.229.67
• 135.233.45.222
• 20.42.65.94
• 85.210.196.11

File paths

• C:\Windows\system32\sc.exe

More Viking samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report