MALICIOUS — 0d7d47a0d4637aaf512e97a25218b4a32e52fbe5fda4ce1d6ebaaf0365e83fe7
MALICIOUS — 0d7d47a0d4637aaf512e97a25218b4a32e52fbe5fda4ce1d6ebaaf0365e83fe7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (77/100), attributed to the Citrate family. 2 of 55 detection engines flagged it.
Identification
- SHA-256:
0d7d47a0d4637aaf512e97a25218b4a32e52fbe5fda4ce1d6ebaaf0365e83fe7 - SHA-1:
ca4bc022c9506456fc985b5f8f366e5e644deea1 - MD5:
9f89b5671a82017fe72c767b953b8b34 - imphash:
a2ae7ab1ebf8e181e65df07bb3a3dfcb - ssdeep:
196608:JTKsaDUzXZVxoh+W4Bp+AWGAQJdO+NPnL/wQEe+auKPXstalwkK:pKsaDUzJLoI7WGAQJdOszwJe+auK0tQo - TLSH:
T1086A33956B42BA43F7E2C3884E2DFE6D60629D986C70C34E40E5E5DC6D8B897E2C5007 - Submitted as: 0d7d47a0d4637aaf512e97a25218b4a32e52fbe5fda4ce1d6ebaaf0365e83fe7
- File type: pe · Size: 9424848 bytes
- Verdict: malicious (77/100) · Family: Citrate
Detections (2 of 55 engines)
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Kaspersky (KVRT): UDS:Backdoor.MSIL.Citrate.gen
Why this verdict
The malicious score of 77/100 is the fusion of 4 weighted signals:
- Memory forensics: 2 finding(s), e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85 - Contacted 30 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://www.clickteam.com/pub - static signal, weight 0.35, confidence 0.60
Dynamic analysis (windows)
524 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
Embedded URLs
- http://www.clickteam.com/pub
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787899927&P2=404&P3=2&P4=PMRQFKV25HBnDmER5r6FSQsblVV3sCWlRKc4pmsc2tuYjIFAVsGcSAiRwdqjyI5%2fN5%2bQodtq57d%2bhmrwlDQeaw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787899992&P2=404&P3=2&P4=RXjzOrK1pZpegQ%2bCXITOaWIX3gz1xOLeyIQ7PPkFSPiXseTY4HpSiDzMCIW43wKnLH%2foTrvykDkzxD6BkMTu4w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787296652&P2=404&P3=2&P4=l1xPPhJZBLYUNCwEHLgSRfEhH1%2b4%2biOB2WP78KJ8GByCMt3YwCBBiaqEp781jU4ULQOMEyhbxG0YnhzjGdNkpw%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787296248&P2=404&P3=2&P4=fYGFN7rOGfbAGHx9l4sIF1JoGg7kPwr2httPejayY11f72Fktm47tM4Jmfut2YoANWQbnzTtgKH4HEWgHAJiKg%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- www.clickteam.com
- i.ca
- y.us
- 2.ca
- 2b.sh
- y.au
Embedded IP addresses
- 4.150.223.103
- 52.123.252.248
- 57.155.104.224
- 4.230.171.124
- 4.144.132.223
- 74.178.240.61
- 74.179.77.164
- 20.42.73.31
- 52.110.12.19
- 52.110.12.3
- 52.123.129.14
- 40.104.4.2
- 20.231.239.246
- 40.103.64.242
- 4.150.223.105
- 52.123.252.246
- 172.178.240.162
- 203.26.79.13
- 52.123.252.222
- 74.178.232.29
- 172.215.188.225
- 52.148.114.188
- 72.153.5.132
- 4.150.223.100
- 52.168.112.67
File paths
- O:\yAOC{
- G:\&
- Z:\1W8
- h:\A/!
- N:\2h
More Citrate samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report