MALICIOUS — 08470ec59c46da7d94b110262505b9c36e1be45039f8feaae4e849d03e316b73

MALICIOUS — 08470ec59c46da7d94b110262505b9c36e1be45039f8feaae4e849d03e316b73 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Multiverze family. 7 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 08470ec59c46da7d94b110262505b9c36e1be45039f8feaae4e849d03e316b73
• SHA-1: 652afc6b74fa0d2c0e822f5b42de58cbdb57496f
• MD5: 9fcd0ac143cd7d7cfbe6097a3dffe0aa
• imphash: 047077021a205359dc9be0523dde827f
• ssdeep: 24576:Q588g3v/xyzHQCFZYyOf30pCqV+DgG2OEcJ35WL91LXcD:QS3xyLpFeD304qVqgfPcJJAAD
• TLSH: T1635412DD41197A80D6B7CB242C505F0EC073B4DE61BE15080A83D6AF3AF3997BAB454A
• Submitted as: 08470ec59c46da7d94b110262505b9c36e1be45039f8feaae4e849d03e316b73
• File type: pe · Size: 1110528 bytes
• Verdict: malicious (97/100) · Family: Multiverze

Detections (7 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
• ClamAV (daily): Win.Trojan.XXMM-6736056-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Detect It Easy (packer/type): DIE:Microsoft Linker
• Microsoft Defender: Trojan:Win32/Multiverze
• Kaspersky (KVRT): UDS:Trojan.Win32.Inject.gen

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 97/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Win.Trojan.XXMM-6736056-0 (rule Win.Trojan.XXMM-6736056-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/Multiverze (rule Trojan:Win32/Multiverze) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

42 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• searchapp.bundleassets.example
• www.msftconnecttest.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• www.bing.com
• desktop-hsgcbep
• aps.prod.windows.com
• config.edge.skype.com
• tas02.sls.update.microsoft.com
• to-do.microsoft.com
• settings-win.data.microsoft.com
• dns.msftncsi.com
• ctldl.windowsupdate.com
• staging.to-do.microsoft.com
• edge.microsoft.com
• teams.microsoft.com
• watson.events.data.microsoft.com
• self.events.data.microsoft.com
• ecs.office.com

Embedded domains

• y5.cc
• staging.to-do.officeppe.com

File paths

• C:\Users\Katy\Desktop\project\poratable
• C:\Users\123\Documents\Visual
• z:\ta6F
• C:\a5pN
• T:\:d:l:t:

More Multiverze samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report