MALICIOUS — 2bd5eaa2b22d2660beea2aafd92f6cc910445808b378b88bb4f1440a877b71ee

MALICIOUS — 2bd5eaa2b22d2660beea2aafd92f6cc910445808b378b88bb4f1440a877b71ee is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sivis family. 7 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 2bd5eaa2b22d2660beea2aafd92f6cc910445808b378b88bb4f1440a877b71ee
SHA-1: bcf4924f946dcfaaa48f121ff72f1311b36421f3
MD5: be63b02213c67fb07efe88c5509e17dd
imphash: b10d16eedb1085ef7262dfc4ab03be6f
ssdeep: 768:olnK2Eq3GcOnUi7eOTJwYf2mGGAHwvLtBu3iqboOYYYYYYYYYYYYYYYmYy6w6chf:KEq3GcOUi7eOTeY+TGx7WHlwla
TLSH: T1B3353BAE2150643FD4F18C4B040CEDBDC483A4E96930478AD294E7F884B857BA67FAD5
Submitted as: 2bd5eaa2b22d2660beea2aafd92f6cc910445808b378b88bb4f1440a877b71ee
File type: pe · Size: 59972 bytes
Verdict: malicious (100/100) · Family: Sivis

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Sivis-9908038-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Sivis-9908038-0 (rule Win.Malware.Sivis-9908038-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Sivis.A (rule Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Agent.es (rule Virus.Win32.Agent.es) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 2 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, http://www.gnu.org/software/coreutils/, http://translationproject.org/team/ - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

18095 behavior events · 0 ATT&CK techniques · 98 dropped files.

Dropped files

C:\$WinREAgent\RollbackInfo.ini - f8fdd9b51da3ed5f557359e27bedd7c9e49fc4cd5d7ab3a94c754735cd20eea5
C:\Program Files\7-Zip\7zFM.exe - 06f1edfeabb5a121f4f262d6b1a17ac88980641e3b7f673e8a63f3100bf2ec05
C:\Program Files\7-Zip\Lang\he.txt - b0484d9021387e545545ce9bb9c0fd10cda6b7eece2db8ed92b404c82bb90c13
C:\Program Files\7-Zip\Lang\fy.txt - ef53a674c66eab9acaa9a92f98ed9d152af9fc50149c3cb6f4fd2e42a6cc04da
C:\Program Files\7-Zip\Lang\hy.txt - d6495012c5b1ed90b5882e5983d3f706d03ac214498ec1228cbaa8cf0789077a
C:\p.ps1 - 86ebe9d3d8dcc2627e5660a797afde01ff774a2284d57dac302c5f8b7fb03740
C:\Program Files\7-Zip\Lang\mr.txt - be5a05cde1062f681d2189756e6e2b77bad8053b370e9d39a2d9b77d15d9a23b
C:\Program Files\7-Zip\Lang\ext.txt - 085919423fbfd806320ff171e14a781daa99ac843d2215053cc5f22c05e8e047
C:\Program Files\7-Zip\Lang\ast.txt - 826fa4e99b90c00c0b9881189d4a93595cdea6436ba6b4783602d96cca6916ad
C:\Program Files\7-Zip\Lang\lv.txt - 00e3103df5c83b14ce5f07a0b59bb6a3fa5e81767d24549b6f5e8cfb68716844
C:\Program Files\7-Zip\Lang\ne.txt - f46317594857cddb59243a1d97f192d7dab8f258ff7a261752c80c19b2691d5c
C:\Program Files\7-Zip\Lang\eo.txt - 20a373460e1d1720ed0192e05a36d497d2346ad75eb72bf57fb4643753f7bd99
C:\Program Files\7-Zip\7zCon.sfx - 8ecf746d89e8c748dada3ddbbc410615f6ca15388939db5c80cd5ff511ff8198
C:\Program Files\7-Zip\Lang\fi.txt - 7eac7c0ba44d801e1f0765d5bade13d7f181ed1cb301edaac61c0e6556eac747
C:\Program Files\7-Zip\Lang\ar.txt - 89d54ce2c475f4caa685aeeedb196ae9bef2e55cb87729821e550127cba36f3a

Embedded URLs

http://creativecommons.org/publicdomain/zero/1.0/
http://www.gnu.org/software/coreutils/
http://translationproject.org/team/
http://gnu.org/licenses/gpl.html
http://www.gnu.org/gethelp/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

creativecommons.org
geocities.com
www.gnu.org
translationproject.org
gnu.org
cygwin.com

Embedded IP addresses

20.42.65.93
52.253.84.76
52.123.252.202
4.230.171.124
104.18.33.89
135.233.45.222
52.110.12.4
52.110.12.15
52.110.12.20
52.110.12.40

File paths

X:\windows\system32\sysreset.exe
C:\Windows.old\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
C:\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1120_none_c3e
C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1_none_eedfed
X:\SysResetTrace-Tel-Merge.etl,
C:\$WINDOWS.~BT\Sources\Panther\SysResetTrace-Tel-Merge.etl)

More Sivis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report