MALICIOUS — 216974cc4040859dfc9aacbf07d3a71adc4484fa83e6a7228e8854a2d6992e7f

MALICIOUS — 216974cc4040859dfc9aacbf07d3a71adc4484fa83e6a7228e8854a2d6992e7f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 216974cc4040859dfc9aacbf07d3a71adc4484fa83e6a7228e8854a2d6992e7f
SHA-1: eff82eef369f749303c33b1646c25b8a3edd8597
MD5: ca7c5542f3c7fa06991c9f221210e291
imphash: 38aa7c2ff6ef0e48a9520d6702d08df4
ssdeep: 6144:5vifikieiisB6xvifikieiisQvifikieiisB6eixTmAcThAkZThMTM1:hGxnLGxnhGxnkix1c60yE
TLSH: T1D748D6DE538D572FC12ACD363C68DADE5851B1F02871A7692EA3823A043293BFD72115
Submitted as: 216974cc4040859dfc9aacbf07d3a71adc4484fa83e6a7228e8854a2d6992e7f
File type: pe · Size: 370035 bytes
Verdict: malicious (99/100)

Detections (4 of 56 engines)

ClamAV (daily): Win.Trojan.Agent-6943819-1
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-6943819-1 (rule Win.Trojan.Agent-6943819-1) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Sivis.A (rule Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Agent.es (rule Virus.Win32.Agent.es) - engine signal, weight 0.55, confidence 0.85
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, https://www.gnu.org/software/automake/manual/automake.html, http://fsmsh.com/2753 - static signal, weight 0.35, confidence 0.60
Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Extracted generic config (4 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

18065 behavior events · 0 ATT&CK techniques · 97 dropped files.

Dropped files

C:\Program Files\7-Zip\Lang\kk.txt - 60a302867929bbe489c7769480988ba18b1309c59b410e55d6945b19b4441bee
C:\Program Files\7-Zip\Lang\af.txt - bdbab2e86a5704ecfa4ecd04c1148056d972b6d0bf2ab3265a653bc908413ec8
C:\Program Files\7-Zip\Lang\hr.txt - 9f7af38c8457153c240c52b5bba7b9c01ea038fda7f1f52d9842cccf641227bc
C:\Program Files\7-Zip\Lang\gl.txt - 1746dcb5c2cb54863a97531a65d60ffafcf112cdacd6722fa7a01f46f6ece37b
C:\Program Files\7-Zip\Lang\kaa.txt - 0f733acf3f602b64b3e9ea27972c14141e186243e4157fcea1cc54b762ae8155
C:\Program Files\7-Zip\Lang\ast.txt - ed67491354571ee120254fd5837073d94448208d9e895db8ebba8357d98704da
C:\Program Files\7-Zip\Lang\ko.txt - 7e1b3f50924916700175c2c6192f462af2fbdc3670c222f17b110290f27eaaee
C:\Program Files\7-Zip\Lang\de.txt - a90558e6206a98a944a816c614ed0ac1a78f6cb2a424062c64404a588f96d811
C:\Program Files\7-Zip\Lang\ka.txt - 9400ea77d6aff3d0a13b05a1d9b63d851019b0ba5884d4c65424e5d925718d02
C:\Program Files\7-Zip\7zFM.exe - 3db50ddc313157e72968bb28c8096d9c275210303c14d668dfdc48bc83062641
C:\PPLFaultTemp\EventAggregationPH.dll - 6d9cee44b7596bfe99c3bda0b5577eef577587ce1b6859b4edb94627f4ced4f3
C:\Program Files\7-Zip\Lang\ext.txt - 0e4f3e0f47f477a17bb29ea6dff42b859611e4fd58141a2c8f6d34d37b960c05
C:\Program Files\7-Zip\Lang\an.txt - 55c90bc237c0c3be949f4dff54279abd790f67404f68560e626876a715af6025
C:\Program Files\7-Zip\Lang\it.txt - 67b1a1c13fa30ca571ae4aa26b107d5be087bba69de92de6c33b0dc65d568d81
C:\Program Files\7-Zip\7z.dll - fef858e1510eecba29f25ef0d0b3b75341ad3e80c0858b56990a83a3456f0b0a

Embedded URLs

http://creativecommons.org/publicdomain/zero/1.0/
https://www.digicert.com/CPS0
http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
http://www.digicert.com/ssl-cps-repository.htm0
http://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
https://www.gnu.org/software/automake/manual/automake.html
http://fsmsh.com/2753
https://autotools.io/index.html
http://miller.emu.id.au/pmiller/books/rmch/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

creativecommons.org
geocities.com
ardownload.adobe.com
www.adobe.com
crl3.digicert.com
crl4.digicert.com
www.digicert.com
cacerts.digicert.com
www.gnu.org
fsmsh.com
autotools.io
miller.emu.id.au
aefd.nelreports.net

Embedded IP addresses

20.184.175.5
4.230.171.124
4.247.188.233
20.247.184.142
74.178.76.128
135.232.92.97
20.184.175.16
104.18.33.89
4.150.223.105
92.223.78.30
172.66.2.5
135.234.160.244
40.84.85.40
4.150.223.106
4.150.223.109
52.148.114.188
52.110.12.31
52.110.12.44

File paths

C:\Windows.old\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
C:\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim][gle=0x00000020]
C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1120_none_c3e
C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1_none_eedfed
X:\SysResetTrace-Tel-Merge.etl,
C:\$WINDOWS.~BT\Sources\Panther\SysResetTrace-Tel-Merge.etl)

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report