MALICIOUS — 0e3a93720591b68ac3b9f469533a4e3d1561605c6a30aab851aa164f02330ac5

MALICIOUS — 0e3a93720591b68ac3b9f469533a4e3d1561605c6a30aab851aa164f02330ac5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Multiverze family. 7 of 53 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 0e3a93720591b68ac3b9f469533a4e3d1561605c6a30aab851aa164f02330ac5
SHA-1: a418b8e3939002f6c00ba47b2a23dc5e352c8082
MD5: 7603ad30ca73d97f319ced3bd17d0595
imphash: 0d52988c17b6d0ad679318ef76f1e151
ssdeep: 1536:8L+O/U7OBmKGS6CBK0t/ZCXPGuxgDM5YKBGNc/5T6JGMcsuCEU4MOUaIOOo/uIm6:8LxUyjp3xCTyDMo7tWWU5xzqi
TLSH: T1123D6CD29D037421E07ADA886C1576FC84A6F4AE3534814D635BC90E10F7A7BB93236E
Submitted as: 0e3a93720591b68ac3b9f469533a4e3d1561605c6a30aab851aa164f02330ac5
File type: pe · Size: 134154 bytes
Verdict: malicious (100/100) · Family: Multiverze

Detections (7 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
ClamAV (daily): Win.Malware.Ulise-9886066-0
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Multiverze!pz
Emsisoft (Emergency Kit): Generic.Dacic.1660.C4F2B6B1
Kaspersky (KVRT): HEUR:Trojan.Win64.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Ulise-9886066-0 (rule Win.Malware.Ulise-9886066-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Multiverze!pz (rule Trojan:Win32/Multiverze!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Generic.Dacic.1660.C4F2B6B1 (rule Generic.Dacic.1660.C4F2B6B1) - engine signal, weight 0.55, confidence 0.85
1 behavioral detection(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 48 external host(s) at runtime (66 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://pm2pavba27wr4m34.onion/command.txt?sh1ff - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60

Dynamic analysis (windows)

2038 behavior events · 1 ATT&CK techniques · 1 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/4714/files/b2fa949e9f05e4df51d349b5f4eb892b42d11a1861eeb3353b92a9d911114cb2 - b2fa949e9f05e4df51d349b5f4eb892b42d11a1861eeb3353b92a9d911114cb2

Embedded URLs

http://pm2pavba27wr4m34.onion/command.txt?sh1ff
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/92621512-d997-4742-9ae0-db0593ed93c6/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/92621512-d997-4742-9ae0-db0593ed93c6?P1=1785965123&P2=404&P3=2&P4=IoQ1z9vgdp8FX4Qjk%2bsGl%2bVOThm4lgFVm9ps1HepNCoYH45pEFZ85oP4II8qWLhBTLOWpiQAddpci70Xnd5gzA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://128.31.0.39:9131/tor/status-vote/current/consensus
http://216.218.219.41/tor/server/fp/460229771c96996c6bab88070d11fa7135820378
http://45.66.35.11/tor/server/fp/646543b979fca3b1433c833f9b6c7c9130403fd5
http://45.66.35.11/tor/server/fp/b536b71a1f5599c39fc8b1915d2ebe3a0deb1403
http://45.66.35.11/tor/server/fp/b543326cf26b23a344b245809bb489fa30265847
http://216.218.219.41/tor/server/fp/b54cf3aa7b13502547be953e9a223d7e0e5c8f9f
http://193.23.244.244/tor/server/fp/1850585be9bca1f80d0a051909c94e49d1c49ed3
http://45.66.35.11/tor/server/fp/18671de5092c67883bfb2450c3267b92618bec66
http://45.66.35.11/tor/server/fp/186f046d8895e13626b363b879bd15f38a52c6bc
http://203.26.79.13/filestreamingservice//files/095b6cce-5952-42aa-a19f-9268ce8ce016/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://45.66.35.11/tor/server/fp/b76960725cff51da878324f5da4882367bb90b62
http://216.218.219.41/tor/server/fp/5557c902bec56826cff3572423684bee501970c9
http://203.26.79.13/filestreamingservice/files/095b6cce-5952-42aa-a19f-9268ce8ce016?P1=1785965186&P2=404&P3=2&P4=ChNkufyfrkaGKcGoJyFXCfM%2bzy3GDm9drJPX8QzqekVR%2bXdjraUU%2bGcNN7saQy89Dtdbh2js7Eb%2beweUtMiQCQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://131.188.40.189/tor/status-vote/current/consensus
http://193.23.244.244/tor/server/fp/8e3092910577346648825d3ed8c9093ad26af341
http://45.66.35.11/tor/server/fp/c4f960fe82653470b0d2db9040e32433d3403568
http://45.66.35.11/tor/server/fp/36b5d69815312f95f4c93e6dbd70ffb105503ca6
http://216.218.219.41/tor/server/fp/b536b71a1f5599c39fc8b1915d2ebe3a0deb1403
http://193.23.244.244/tor/server/fp/7f9013d5d7084bf730cb0983c8176db9786ab926
http://216.218.219.41/tor/server/fp/b543326cf26b23a344b245809bb489fa30265847
http://193.23.244.244/tor/server/fp/b54cf3aa7b13502547be953e9a223d7e0e5c8f9f

Embedded domains

pm2pavba27wr4m34.onion
oneclient.sfx.ms

Embedded IP addresses

23.33.238.102
150.171.22.17
52.123.128.14
52.98.140.2
131.253.33.203
151.101.30.172
52.98.8.34
23.11.36.157
20.42.179.192
23.40.52.85
20.184.175.17
20.42.65.89
57.155.104.224
74.178.240.61
20.165.94.54
4.150.223.105
74.178.76.128
172.178.240.163
203.26.79.13
13.69.116.105
150.171.28.11
23.221.133.185
128.31.0.39
216.218.219.41
45.66.35.11

More Multiverze samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report