MALICIOUS — f06550e50aa026d3973d2096782b4842db78f8ea89c55b4a8b4e43ce845c3e42
MALICIOUS — f06550e50aa026d3973d2096782b4842db78f8ea89c55b4a8b4e43ce845c3e42 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fileinfector family. 5 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.
Identification
- SHA-256:
f06550e50aa026d3973d2096782b4842db78f8ea89c55b4a8b4e43ce845c3e42 - SHA-1:
507aeb46369e5bb5b51499f6875c06d57b373a57 - MD5:
71668f306ca8e8b9712ef0090625ed9d - imphash:
895fbb56c02c3d2bca3125cef5da8730 - File type: pe · Size: 433431 bytes
- Verdict: malicious (100/100) · Family: Fileinfector
Detections (5 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Fileinfector-9832954-0
- Detect It Easy (packer/type): DIE:UPX 3.96
- Kaspersky (KVRT): Virus.Win32.Lamer.ks
- Microsoft Defender: Trojan:Win32/Vindor!pz
MITRE ATT&CK
Dynamic analysis (windows)
74656 behavior events · 2 ATT&CK techniques · 28 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- www.freeav.com
- www.avira.com
- script.crazyegg.com
- www.webassetscdn.com
- nexus.ensighten.com
- assets.adobedtm.com
- t.nc0.co
- doh.cq0.co
- s.go-mpulse.net
- widget.trustpilot.com
Dropped files
- /opt/CAPEv2/storage/analyses/14932/files/2a3a0f3d477b6deab575786714f76d22d2e291037daddc9270604a2a4ab6b6a1 —
2a3a0f3d477b6deab575786714f76d22d2e291037daddc9270604a2a4ab6b6a1 - /opt/CAPEv2/storage/analyses/14932/files/c1ad747a0ebc98113afcba2f3b1df75a5f6868d26a94f585b2d01837be99516f —
c1ad747a0ebc98113afcba2f3b1df75a5f6868d26a94f585b2d01837be99516f - /opt/CAPEv2/storage/analyses/14932/files/66f68a2c3440bcea3bd203d4b3f9dc64562766b95340307c9b269b257bb26c83 —
66f68a2c3440bcea3bd203d4b3f9dc64562766b95340307c9b269b257bb26c83 - /opt/CAPEv2/storage/analyses/14932/files/2ec20cf70397da086689bcc0b128c997813ddd72157ec1ea5c7883c807bd834e —
2ec20cf70397da086689bcc0b128c997813ddd72157ec1ea5c7883c807bd834e - /opt/CAPEv2/storage/analyses/14932/files/133d65df6b3d2c8bb349d85ed18b996ff79605a38ab582d590efafb77ef1f1b4 —
133d65df6b3d2c8bb349d85ed18b996ff79605a38ab582d590efafb77ef1f1b4 - /opt/CAPEv2/storage/analyses/14932/files/9a9541d22c5417466c9cc74c29038a838b0ab48c351b84f68434b6c2e09a54c0 —
9a9541d22c5417466c9cc74c29038a838b0ab48c351b84f68434b6c2e09a54c0 - /opt/CAPEv2/storage/analyses/14932/files/4411b2470163218593449b8b341686f6fd1c650cb7e4866416a0b7cac52bdc1d —
4411b2470163218593449b8b341686f6fd1c650cb7e4866416a0b7cac52bdc1d - /opt/CAPEv2/storage/analyses/14932/files/974f2c08b59835777bc276c5f4ac131b9f79593914aa9549617d5342d633b160 —
974f2c08b59835777bc276c5f4ac131b9f79593914aa9549617d5342d633b160 - /opt/CAPEv2/storage/analyses/14932/files/ad11f641ddeb50cdb02d0c770ec96cd22b88cc4bc91c28a09bd4ecca4d63ab5a —
ad11f641ddeb50cdb02d0c770ec96cd22b88cc4bc91c28a09bd4ecca4d63ab5a - /opt/CAPEv2/storage/analyses/14932/files/bba3a45fe66db74c44104a78b002543f3761e1d5a7e139f33fbb834d52b12865 —
bba3a45fe66db74c44104a78b002543f3761e1d5a7e139f33fbb834d52b12865 - /opt/CAPEv2/storage/analyses/14932/files/a432ccda1222965adcc12296c990cdfa3932d44bf2bd192390ad4b78160a9e5e —
a432ccda1222965adcc12296c990cdfa3932d44bf2bd192390ad4b78160a9e5e - /opt/CAPEv2/storage/analyses/14932/files/345a1c8d3d31b8bf42d2ead7082ffb880976d497523768530ced21a0ef5676fc —
345a1c8d3d31b8bf42d2ead7082ffb880976d497523768530ced21a0ef5676fc - /opt/CAPEv2/storage/analyses/14932/files/71809a6eea8793f8b6e42684d7760fa66e9ded3c9ff5304ed5af77f9368aa6ca —
71809a6eea8793f8b6e42684d7760fa66e9ded3c9ff5304ed5af77f9368aa6ca - /opt/CAPEv2/storage/analyses/14932/files/0b62b7f69d711fc2fefb1c12773ea04d78f935babf627a6bfccb74b019d6e346 —
0b62b7f69d711fc2fefb1c12773ea04d78f935babf627a6bfccb74b019d6e346 - /opt/CAPEv2/storage/analyses/14932/files/d03ce4c91c27add9a09bee39874edebe5c9aed0f18b606817b26b0b8f675d1b4 —
d03ce4c91c27add9a09bee39874edebe5c9aed0f18b606817b26b0b8f675d1b4
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786590226&P2=404&P3=2&P4=Dp1Ew%2fARiFr5NDyARmRmHaVZwO10qwofu4S%2fQrjY2bxa2bctlbAhWm5j2oZBhXZCOu1KqQSu75iPP9YP%2bOkMTQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786590247&P2=404&P3=2&P4=KabuCUbzwTy9aDzBMnjtUlEcJUy4RKiIYIPGO88Ifrv5Ht13g1lb2GfxFNmzmBMn2r6c7P9nOhsqvxNfcbTdWg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://www.freeav.com/
Embedded domains
- www.freeav.com
- www.avira.com
- script.crazyegg.com
- www.webassetscdn.com
- nexus.ensighten.com
- assets.adobedtm.com
- t.nc0.co
- doh.cq0.co
- s.go-mpulse.net
- widget.trustpilot.com
- dpm.demdex.net
- symantec.demdex.net
- symantec.tt.omtrdc.net
- data.privacy.ensighten.com
- www.nortonlifelock.com
- mhubc.avira.com
- rmbyy5ra.avira.com
- oms.avira.com
- getrockerbox.com
- www.antispyware.com
- img6.wsimg.com
- img1.wsimg.com
- pagead2.googlesyndication.com
- edge.fullstory.com
- secure.quantserve.com
Embedded IP addresses
- 103.229.10.211
- 100.58.53.25
- 32.185.157.5
- 3.231.116.23
- 35.165.194.112
- 54.164.207.187
- 20.50.201.205
- 52.123.252.247
- 57.155.104.224
- 4.144.132.114
- 4.230.171.124
- 74.179.77.204
- 135.232.92.97
- 4.150.223.96
- 20.231.239.246
- 52.123.129.14
- 40.103.64.242
- 4.150.223.97
- 20.184.175.11
- 135.233.45.221
- 135.233.45.223
- 20.165.94.46
- 203.26.79.13
- 4.195.116.8
- 142.250.195.142
More Fileinfector samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report