MALICIOUS — 08d90e579cbbf977d33794b5d8ce3c59fce807f59b2654b8bbdcc2237ed1bf33

MALICIOUS — 08d90e579cbbf977d33794b5d8ce3c59fce807f59b2654b8bbdcc2237ed1bf33 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sivis family. 9 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 08d90e579cbbf977d33794b5d8ce3c59fce807f59b2654b8bbdcc2237ed1bf33
SHA-1: 8af4beee48901ed7c859149c6546ce9109c3300e
MD5: 9284f9d47c997cc66eb4cbd3d42a3b30
imphash: 38aa7c2ff6ef0e48a9520d6702d08df4
ssdeep: 6144:TeEriRsAxH/K2jye9POln4RUOeinwl5gaO5W2cRFzZnk6kA:igixH/dpPOV4uOeinggFQFzJkA
TLSH: T1E54A8EB1111A1135D9FAAEB0A41CCE7CD0637949703C6F5D9087EB5C90E8AD3E8FA491
Submitted as: 08d90e579cbbf977d33794b5d8ce3c59fce807f59b2654b8bbdcc2237ed1bf33
File type: pe · Size: 436999 bytes
Verdict: malicious (100/100) · Family: Sivis

Detections (9 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Agent-6943819-1
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX 3.91
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Trellix Stinger (McAfee): PolyPatch-UPX
Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-6943819-1 (rule Win.Trojan.Agent-6943819-1) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 6552) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Virus:Win32/Sivis.A (rule Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PolyPatch-UPX (rule PolyPatch-UPX) - engine signal, weight 0.55, confidence 0.85
Contacted 44 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:UPX 3.91 (rule DIE:UPX 3.91) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX, UPX 3.91 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

25484 behavior events · 1 ATT&CK techniques · 97 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/12480/files/e0636bca11fbb0ba43953674fc3675df0536a1550a83540cf116396832b356ef - e0636bca11fbb0ba43953674fc3675df0536a1550a83540cf116396832b356ef
/opt/CAPEv2/storage/analyses/12480/files/137d47d63786b4ec6564d772cc1867885282a0c39a07b41f77d91b2ccc3472f7 - 137d47d63786b4ec6564d772cc1867885282a0c39a07b41f77d91b2ccc3472f7
/opt/CAPEv2/storage/analyses/12480/files/0cae5d14d0547e13a91d16804784bd59c26a78de9f0b398f2f1ba9aec599e428 - 0cae5d14d0547e13a91d16804784bd59c26a78de9f0b398f2f1ba9aec599e428
/opt/CAPEv2/storage/analyses/12480/files/e0b5afbdca96e5b80720745493c4b93a8c88bc24e379ad4383cbc502a8d324bc - e0b5afbdca96e5b80720745493c4b93a8c88bc24e379ad4383cbc502a8d324bc
/opt/CAPEv2/storage/analyses/12480/files/cd07713488c838844258848e627dd822dd9f1ec78464b88f7ca4645cf4b8f1d6 - cd07713488c838844258848e627dd822dd9f1ec78464b88f7ca4645cf4b8f1d6
/opt/CAPEv2/storage/analyses/12480/files/f411a9e3f9c59dd5e5cf758d40a81d054cb9e564106739a8ee5ad71a3c5411b0 - f411a9e3f9c59dd5e5cf758d40a81d054cb9e564106739a8ee5ad71a3c5411b0
/opt/CAPEv2/storage/analyses/12480/files/9cc7a67911cbba289b9c02076dbf0d77f92ec94f994601087e677f6acb0c5d40 - 9cc7a67911cbba289b9c02076dbf0d77f92ec94f994601087e677f6acb0c5d40
/opt/CAPEv2/storage/analyses/12480/files/d010fec8ec5b1326ea589abda9ec2f51fc32fde016bd47d2d3d657ed55036149 - d010fec8ec5b1326ea589abda9ec2f51fc32fde016bd47d2d3d657ed55036149
/opt/CAPEv2/storage/analyses/12480/files/9310440646990228193cfb38ecc2485ae7574ed447f63a679a74bba60cfe0742 - 9310440646990228193cfb38ecc2485ae7574ed447f63a679a74bba60cfe0742
/opt/CAPEv2/storage/analyses/12480/files/683e5caaff2386cd62236dc47fd7cf8c0dc4264908cc245fdd469cec562c3826 - 683e5caaff2386cd62236dc47fd7cf8c0dc4264908cc245fdd469cec562c3826
/opt/CAPEv2/storage/analyses/12480/files/314cdfd5f76672f7cc5391ab29cadc53ec08be0c6d327603e4ce2ee94e2dfe1a - 314cdfd5f76672f7cc5391ab29cadc53ec08be0c6d327603e4ce2ee94e2dfe1a
/opt/CAPEv2/storage/analyses/12480/files/8c7e30c888951d635f3b6de1272c77cf63e27a8667b7c8e75836c8cec4624a8a - 8c7e30c888951d635f3b6de1272c77cf63e27a8667b7c8e75836c8cec4624a8a
/opt/CAPEv2/storage/analyses/12480/files/591c22edb4dbbcbd7e7e1ca3fa4aec255cd0d05acac5c42bf3b3b823ea802a43 - 591c22edb4dbbcbd7e7e1ca3fa4aec255cd0d05acac5c42bf3b3b823ea802a43
/opt/CAPEv2/storage/analyses/12480/files/2a3001597712a82be4730f2f3a1409ff90f208f53973149e26e58e28dae24240 - 2a3001597712a82be4730f2f3a1409ff90f208f53973149e26e58e28dae24240
/opt/CAPEv2/storage/analyses/12480/files/d9ab3e1bf424d00cfd875dd4f699e9ad5b6d24c064c7dfb441880e20023b5261 - d9ab3e1bf424d00cfd875dd4f699e9ad5b6d24c064c7dfb441880e20023b5261

Embedded URLs

http://creativecommons.org/publicdomain/zero/1.0/
http://www.adobe.com/go/reader_system_reqs_it.UnmoveFilesRimozione
http://www.adobe.com/go/reader_system_reqs_it
https://www.digicert.com/CPS0
http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
http://www.digicert.com/ssl-cps-repository.htm0
https://d.symcb.com/rpa0
http://s.symcb.com/universal-root.crl0
https://d.symcb.com/rpa0@
http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786523465&P2=404&P3=2&P4=iQV89scIabl8AxAXFGlMTQ0hFzuitTsnPK50JFJ3ONTQGVv0XA%2fZC4HcIDU4hfubbs%2bKtkEmYnl9GEycZcchpQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786523492&P2=404&P3=2&P4=KiZZqFk1JtF%2bUPFeTsjsiJVQIAnlha04oVGGHbyM2VaGYiagrkefylWAOnymOF%2fngE0i8CPF7XHJAficrWOoqg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

creativecommons.org
geocities.com
www.adobe.com
helpx.adobe.com
www.microsoft.com
crl3.digicert.com
crl4.digicert.com
www.digicert.com
cacerts.digicert.com
d.symcb.com
s.symcb.com
ts-crl.ws.symantec.com
ts-aia.ws.symantec.com

Embedded IP addresses

40.74.98.198
4.230.171.124
57.154.63.210
4.144.132.114
74.178.76.128
20.42.65.93
74.178.76.54
203.26.79.13
40.79.167.10
52.123.252.247
20.165.94.46
135.234.160.246
52.168.117.170
40.79.150.121
72.145.35.108
20.42.179.192
135.232.92.34
52.148.114.188
135.233.95.144
135.234.160.244
172.170.180.133
20.50.201.203
52.123.252.238
92.223.78.30
52.110.12.11

More Sivis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report