MALICIOUS — 1910be7ebeb146382095b3269a4b6d10acfdd4bee5e3240bc15a58b13d24e07f

MALICIOUS — 1910be7ebeb146382095b3269a4b6d10acfdd4bee5e3240bc15a58b13d24e07f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sivis family. 7 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 1910be7ebeb146382095b3269a4b6d10acfdd4bee5e3240bc15a58b13d24e07f
SHA-1: d39bde337b0548697a50e99d8597bf274d47cdee
MD5: 02b7a12a22d1aee8dbe691e358e45195
imphash: b10d16eedb1085ef7262dfc4ab03be6f
ssdeep: 192:VM7lkqCyqT8SJkD22413UA9O6E5GrPTH3oF8nG1b7Fg+NGpWQAX:olDCrkK2EkAs6EGrPDYOnG1b7Fg+NGpk
TLSH: T126247D9B2268F717C622DBD711DCE99D81C5B4E447F200B1C53146B924DA48BAFD3108
Submitted as: 1910be7ebeb146382095b3269a4b6d10acfdd4bee5e3240bc15a58b13d24e07f
File type: pe · Size: 11864 bytes
Verdict: malicious (100/100) · Family: Sivis

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Sivis-9908038-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Sivis-9908038-0 (rule Win.Malware.Sivis-9908038-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Sivis.A (rule Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Agent.es (rule Virus.Win32.Agent.es) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

21327 behavior events · 0 ATT&CK techniques · 98 dropped files.

Dropped files

C:\$WinREAgent\Backup\SrSettings.ini - 625688399f0182662d9eab71ae70a0a3e99570cd59a9d69c1c3a54777c983c8f
C:\Program Files\7-Zip\Lang\pt.txt - eb12797e317b894b5851503537c8c24fa289608b02b6650eba9169da922b0b5a
C:\Program Files\7-Zip\Lang\mn.txt - cf79e16a8dfa666224cca60a96d441ea38e02d285b6fb43de74b648aa470c55b
C:\Program Files\7-Zip\7z.dll - 3b704f039685484774e01e64ed9a88d1334fb3f4b711266cd6d0b6da5b45d33f
C:\Program Files\7-Zip\Lang\ast.txt - 3dce5a9fffcd68c19801837b4fdaf097cff44511ca089514fb8e83db1598af69
C:\Program Files\7-Zip\History.txt - 6bbfc31819391d7c1d518898bac6bda242571b8cea04c816b6bdfa8a73f1a4f5
C:\$WinREAgent\Backup\boot.sdi - b292e5818dea3ac88921f476ae97e1eb02e924b451240883748073ba7f3db822
C:\Program Files\7-Zip\Lang\ku-ckb.txt - c1d2cb5f5d106d713c81a5b15a4033c16dc88dd9ff21940104e8f2acde4b0f4f
C:\Program Files\7-Zip\Lang\kk.txt - d4c3239193846a083fc03332b3919b00551209c60598f6bd0e1c24ab3adff6ef
C:\Program Files\7-Zip\Lang\lij.txt - 15ded4bd90d9ed7489193ebc016cbcd4f805f7fa858003d3fc6705a6eddd9c96
C:\Program Files\7-Zip\Lang\nb.txt - 7a6582f3d88d3b57f01536cd8f22c37139f4c77df9855ccc5b354de90f37b2a9
C:\Program Files\7-Zip\Lang\da.txt - f3c2b5be779203affa829152abac4d7c9a9d5f6265233038cc786335ba579e94
C:\Program Files\7-Zip\Lang\pt-br.txt - c8b724c543b76d8c045d51a60d594e947549c465a9f57565fe2d49f92bb9ffb5
C:\Program Files\7-Zip\Lang\bg.txt - b952e61c482f16d656b465a58b87a4f5f21a36200ef44e1bea6d374eb2e4771a
C:\Program Files\7-Zip\7-zip.chm - 4e5acd942e256fa6e9ba3d1948e2725ec8638572a5b03ae7fac8dd6ca8925512

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

4.207.44.67
4.230.171.124
172.215.188.225
20.247.185.124
57.155.101.212
74.178.76.128
74.178.76.54
4.150.223.112
74.179.77.204
104.18.33.89
20.184.175.3
92.223.78.30
172.178.240.162
40.79.197.34
4.150.223.107
52.110.12.28
52.110.12.32

File paths

C:\Windows.old
C:\.
C:\Windows.old\Windows\System32\Config\Software.
C:\\Windows\System32\Config\Software.

More Sivis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report