MALICIOUS — 20919b03f03f7e4329624ff60d6c1ec208c077c12b556789601ce35ad9ec26c4

MALICIOUS — 20919b03f03f7e4329624ff60d6c1ec208c077c12b556789601ce35ad9ec26c4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sivis family. 6 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 20919b03f03f7e4329624ff60d6c1ec208c077c12b556789601ce35ad9ec26c4
SHA-1: 0f86ef983b2706667ca0843a08ec335bb30deaac
MD5: 52b721e06123501723f967fe308e6106
imphash: 38aa7c2ff6ef0e48a9520d6702d08df4
ssdeep: 12288:uC8SFhNGpW8FhNGpWvlEFMFnoEFMFnoJSFlL9dOjXFbwmxX7Ja6qE+0OwFVv:1FhNGpW8FhNGpWvlEFMFnoEFMFnoAnLm
TLSH: T1094A6C35114E1322D9F9EE7050188EBCA473B58470752FAE824BCA5C51B47E3EEF98A4
Submitted as: 20919b03f03f7e4329624ff60d6c1ec208c077c12b556789601ce35ad9ec26c4
File type: pe · Size: 451359 bytes
Verdict: malicious (100/100) · Family: Sivis

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Agent-6943819-1
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-6943819-1 (rule Win.Trojan.Agent-6943819-1) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Sivis.A (rule Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Agent.es (rule Virus.Win32.Agent.es) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, http://www.gnu.org/licenses/ - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

18783 behavior events · 0 ATT&CK techniques · 97 dropped files.

Dropped files

a19ab1ba587e2baab9457366c4a4b3890d6a1b6d6cc99318d108d2e5efea1167 - a19ab1ba587e2baab9457366c4a4b3890d6a1b6d6cc99318d108d2e5efea1167
C:\Program Files\7-Zip\History.txt - ed17770be2ce50a979e601a0682cbe3b6b32e52e62be99f7414a824ef0fdb81f
C:\Program Files\7-Zip\Lang\nb.txt - 4435b004e0b243ad807f75684685e67acb51987f08e07032b4c623ecfbed60bc
C:\Program Files\7-Zip\Lang\ko.txt - 09bdcab398411ec6b5e6ed8518c8a4e6f7129bb9cf6bf337f4504c2bc006cbe3
C:\Program Files\7-Zip\Lang\es.txt - 57f735331538895f59a9f56a00de852aa55742b47fb9efe129bb07389579c802
C:\$WinREAgent\Rollback.xml - 156b9973ff503e854a9670a63a9cdb6bb04e3bb9604c6c760d6570893e7b788c
C:\Program Files\7-Zip\Lang\br.txt - b00028b1fbb8cebeffcce5f2ccaab3b5fa5b08dc357fbaddbeb3f85d8588bb7c
d3b80a3fa1fcaeb0432444d207fdd6f95eb59715dc384ad34a6e2b51ba3e319e - d3b80a3fa1fcaeb0432444d207fdd6f95eb59715dc384ad34a6e2b51ba3e319e
C:\Program Files\7-Zip\Lang\cy.txt - 78e4ee650f67108fb2e463f6b631a7624527f8edbe9af50559375da7f7d6238b
C:\Program Files\7-Zip\Lang\en.ttt - 7345166bf30fdbce1225ee27027a9b50ea538491a581509418d0b4a05653a1bf
C:\Program Files\7-Zip\Lang\et.txt - 1881d04fccdeef9fff86e1926c0a82af147222ac986bea096500827180d47624
C:\Program Files\7-Zip\Lang\kab.txt - 7014dc8200cb2f5e6244905c8d011b0377b5198b08b70b9d39cfb6a78b2e7781
C:\Program Files\7-Zip\7-zip.chm - b60b2a79d8d8f49dfab9d89f1b7d222f382146e852d3a407675cd650979f3ed8
C:\Program Files\7-Zip\Lang\fr.txt - a66257d3cdbd80ab446243cbf6242b5752649b060b9ece3783e88c3ed796f9b3
C:\Program Files\7-Zip\Lang\az.txt - 87e054471c25f551643e0b4fe1b581854af6daa4f3e8cfb82b97360d9d387ee8

Embedded URLs

http://creativecommons.org/publicdomain/zero/1.0/
http://www.gnu.org/licenses/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

creativecommons.org
geocities.com
cwru.edu
gnu.org
www.gnu.org

Embedded IP addresses

20.42.73.28
4.230.171.124
85.210.193.152
104.18.33.89
74.179.77.164
20.89.1.11
74.178.76.128
20.247.185.124
135.233.95.144
172.178.240.161
20.184.175.11
52.110.12.15
52.110.12.47

File paths

C:\Windows.old\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
C:\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim][gle=0x00000020]
C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1120_none_c3e
C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1_none_eedfed
X:\SysResetTrace-Tel-Merge.etl,
C:\$WINDOWS.~BT\Sources\Panther\SysResetTrace-Tel-Merge.etl)
C:\Windows.old
C:\.
C:\Windows.old\Windows\System32\Config\Software.
C:\\Windows\System32\Config\Software.

More Sivis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report