MALICIOUS — 04db318158b0ed7644a8251a9d513eb915fd22fea3363101cdd1086dac577874

MALICIOUS — 04db318158b0ed7644a8251a9d513eb915fd22fea3363101cdd1086dac577874 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sivis family. 9 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 04db318158b0ed7644a8251a9d513eb915fd22fea3363101cdd1086dac577874
SHA-1: e027eea2f2ba2e36c28da431af9691d7df2e46b9
MD5: cbc296cfc683f238f621a3182a93a87e
imphash: 38aa7c2ff6ef0e48a9520d6702d08df4
ssdeep: 6144:TeEriRsAxH/K2jye9POln4RUOeinwl5gaO5W2cRFzZnk6ko:igixH/dpPOV4uOeinggFQFzJko
TLSH: T1E24A8EB1111A1135D9FAAEB0A41CCE7CD0637949703C6F5E9087EB5C90E8AD3E8FA491
Submitted as: 04db318158b0ed7644a8251a9d513eb915fd22fea3363101cdd1086dac577874
File type: pe · Size: 436550 bytes
Verdict: malicious (100/100) · Family: Sivis

Detections (9 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Agent-6943819-1
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX 3.91
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Trellix Stinger (McAfee): PolyPatch-UPX
Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-6943819-1 (rule Win.Trojan.Agent-6943819-1) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Sivis.A (rule Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PolyPatch-UPX (rule PolyPatch-UPX) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Agent.es (rule Virus.Win32.Agent.es) - engine signal, weight 0.55, confidence 0.85
Contacted 37 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:UPX 3.91 (rule DIE:UPX 3.91) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX, UPX 3.91 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

25483 behavior events · 1 ATT&CK techniques · 96 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/12516/files/eda9c11f6180ac4518d9ab3e9f915ffb7eb4a963ca15c87614a86d6e73a63f5d - eda9c11f6180ac4518d9ab3e9f915ffb7eb4a963ca15c87614a86d6e73a63f5d
/opt/CAPEv2/storage/analyses/12516/files/b81fade54ef90872c2013f03dd0709ac0091a4e9ed1f66e458d328c4a114067c - b81fade54ef90872c2013f03dd0709ac0091a4e9ed1f66e458d328c4a114067c
/opt/CAPEv2/storage/analyses/12516/files/2a1b0d7e6617f79cb90225c55d386b2d585b45ba87605852b47e9b039d78548d - 2a1b0d7e6617f79cb90225c55d386b2d585b45ba87605852b47e9b039d78548d
/opt/CAPEv2/storage/analyses/12516/files/6c63df727e651f29260d3db50513b9ceceb4b6f277f16e63b7236f758cf4e189 - 6c63df727e651f29260d3db50513b9ceceb4b6f277f16e63b7236f758cf4e189
/opt/CAPEv2/storage/analyses/12516/files/f0482e59ec24038516389926f4378bcafb600c51154a28c921254c3eb979b4df - f0482e59ec24038516389926f4378bcafb600c51154a28c921254c3eb979b4df
/opt/CAPEv2/storage/analyses/12516/files/317055c2ace2c80e9134ecaf6a4be301c8d929ecdf28ecbce81cf29d1bc1640e - 317055c2ace2c80e9134ecaf6a4be301c8d929ecdf28ecbce81cf29d1bc1640e
/opt/CAPEv2/storage/analyses/12516/files/fc480bdd9490542cceeb4001c95ffb12db64d0b9caa4c306017cb8bd4ad299c0 - fc480bdd9490542cceeb4001c95ffb12db64d0b9caa4c306017cb8bd4ad299c0
/opt/CAPEv2/storage/analyses/12516/files/4b58a6950e8dca8247831ac4b1406d90efe432ef8cbfa86a72010de81be36a62 - 4b58a6950e8dca8247831ac4b1406d90efe432ef8cbfa86a72010de81be36a62
/opt/CAPEv2/storage/analyses/12516/files/a1b73d22a885de0dada83023b34db97a0a6ccdbf3c166aeada1797f0c7b97f6e - a1b73d22a885de0dada83023b34db97a0a6ccdbf3c166aeada1797f0c7b97f6e
/opt/CAPEv2/storage/analyses/12516/files/8ead462b8a8a2e03de8aa6b67605c9b25e146b6783c4cfd78922f9226084f022 - 8ead462b8a8a2e03de8aa6b67605c9b25e146b6783c4cfd78922f9226084f022
/opt/CAPEv2/storage/analyses/12516/files/6d05459a1082b5cf9d3a280583c7c75665cc125547c1d3d6aab96adb42494bb3 - 6d05459a1082b5cf9d3a280583c7c75665cc125547c1d3d6aab96adb42494bb3
/opt/CAPEv2/storage/analyses/12516/files/11cffd08567072a5eab2bd77ee13f35ac7801c325da542b7d7a92ab30f66e7ac - 11cffd08567072a5eab2bd77ee13f35ac7801c325da542b7d7a92ab30f66e7ac
/opt/CAPEv2/storage/analyses/12516/files/1ff0d045fe228f4f99264049cb243882ced44d1cb5939d8e3b472cafe9cf676c - 1ff0d045fe228f4f99264049cb243882ced44d1cb5939d8e3b472cafe9cf676c
/opt/CAPEv2/storage/analyses/12516/files/a04556daa503a07431f1cc2d860e47a691232aa8aa2edf8dcc170f2ccf866a23 - a04556daa503a07431f1cc2d860e47a691232aa8aa2edf8dcc170f2ccf866a23
/opt/CAPEv2/storage/analyses/12516/files/86b1c5d43d4ff6a527fdad46ab236fed42a0bb15b76d079bc65fe1dfb8cc6e4d - 86b1c5d43d4ff6a527fdad46ab236fed42a0bb15b76d079bc65fe1dfb8cc6e4d

Embedded URLs

http://creativecommons.org/publicdomain/zero/1.0/
http://www.adobe.com/go/reader_system_reqs_it.UnmoveFilesRimozione
http://www.adobe.com/go/reader_system_reqs_it
https://www.digicert.com/CPS0
http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
http://www.digicert.com/ssl-cps-repository.htm0
https://d.symcb.com/rpa0
http://s.symcb.com/universal-root.crl0
https://d.symcb.com/rpa0@
http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786524521&P2=404&P3=2&P4=LLZ2DmVaV6GwgPeeCcQ0gprkSP6gx9MHUPmhln3486Tz8TZ8pywGIC2lQjW%2bO24MQX2Vk1qsjZOYSPgea6xd%2fg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/we1/_-4iFwfCacM.crl

Embedded domains

creativecommons.org
geocities.com
www.adobe.com
helpx.adobe.com
www.microsoft.com
crl3.digicert.com
crl4.digicert.com
www.digicert.com
cacerts.digicert.com
d.symcb.com
s.symcb.com
ts-crl.ws.symantec.com
ts-aia.ws.symantec.com

Embedded IP addresses

51.105.71.136
52.123.252.230
57.155.101.212
4.230.171.124
4.144.132.223
74.178.240.61
20.165.94.54
20.42.65.84
52.123.252.219
135.234.160.246
203.26.79.13
74.178.232.29
52.123.252.225
135.233.45.221
142.250.195.131
52.148.114.188
72.153.5.137
52.110.12.37
52.110.12.14

More Sivis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report