MALICIOUS — 2e0bf3d3da5a250210e0e3fa2d2fdeca431354798cf2f31ed19f540c5ae04468

MALICIOUS — 2e0bf3d3da5a250210e0e3fa2d2fdeca431354798cf2f31ed19f540c5ae04468 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sivis family. 9 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 2e0bf3d3da5a250210e0e3fa2d2fdeca431354798cf2f31ed19f540c5ae04468
SHA-1: bae3d34415732ac3cac50917443d2358039319f1
MD5: e4aeb9cca522fbd009ddedf9f23501c7
imphash: 38aa7c2ff6ef0e48a9520d6702d08df4
ssdeep: 6144:TeEriRsAxH/K2jye9POln4RUOeinwl5gaO5W2cRFU:igixH/dpPOV4uOeinggFQFU
TLSH: T16C498EB2111A1135D9FAAEB0A41CCE7CD0637949703C6F5E9087EB5C90D8AD3E8FA491
Submitted as: 2e0bf3d3da5a250210e0e3fa2d2fdeca431354798cf2f31ed19f540c5ae04468
File type: pe · Size: 410937 bytes
Verdict: malicious (100/100) · Family: Sivis

Detections (9 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Agent-6943819-1
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX 3.91
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Trellix Stinger (McAfee): PolyPatch-UPX
Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-6943819-1 (rule Win.Trojan.Agent-6943819-1) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 8 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 4380) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Virus:Win32/Sivis.A (rule Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PolyPatch-UPX (rule PolyPatch-UPX) - engine signal, weight 0.55, confidence 0.85
Contacted 33 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:UPX 3.91 (rule DIE:UPX 3.91) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX, UPX 3.91 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

25479 behavior events · 1 ATT&CK techniques · 97 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/12312/files/71c69c7ccaa8a5ac64af519ab42f8cbbd00922634918100e515c0630041cdfa2 - 71c69c7ccaa8a5ac64af519ab42f8cbbd00922634918100e515c0630041cdfa2
/opt/CAPEv2/storage/analyses/12312/files/005b6e4198da136858de2256f0e427abf0a8599051cbd3735b36b2e274c8c8a8 - 005b6e4198da136858de2256f0e427abf0a8599051cbd3735b36b2e274c8c8a8
/opt/CAPEv2/storage/analyses/12312/files/a84da0e70ea853b29d7b02a9396ab3fece3d027f9de50b34e451853e7c6715ca - a84da0e70ea853b29d7b02a9396ab3fece3d027f9de50b34e451853e7c6715ca
/opt/CAPEv2/storage/analyses/12312/files/32915932892fda09760bf83fe35d2cfd048ee4ca284ce13ce12309510531eec0 - 32915932892fda09760bf83fe35d2cfd048ee4ca284ce13ce12309510531eec0
/opt/CAPEv2/storage/analyses/12312/files/df2b5c0d6a1993dabfff0c5080ee5a4c2557d87c0de070782ab053bc183c42e7 - df2b5c0d6a1993dabfff0c5080ee5a4c2557d87c0de070782ab053bc183c42e7
/opt/CAPEv2/storage/analyses/12312/files/b739207c649a90ce73f41355abae81dd3f4cfd74c7942e4f72b8b8fbf2faa98a - b739207c649a90ce73f41355abae81dd3f4cfd74c7942e4f72b8b8fbf2faa98a
/opt/CAPEv2/storage/analyses/12312/files/ca83dcf29f7eceac65c816d624b4613ac36bed131946c5c2ecf0620479653067 - ca83dcf29f7eceac65c816d624b4613ac36bed131946c5c2ecf0620479653067
/opt/CAPEv2/storage/analyses/12312/files/3f059ff833dd1afadc4d6dffa78e30c93fcff199cbb90f6ce4d24a58192f1eb3 - 3f059ff833dd1afadc4d6dffa78e30c93fcff199cbb90f6ce4d24a58192f1eb3
/opt/CAPEv2/storage/analyses/12312/files/fdefb2b58d8a0631299ea15f88bca16f6a37a36d38e8ff48b027487702bdcd12 - fdefb2b58d8a0631299ea15f88bca16f6a37a36d38e8ff48b027487702bdcd12
/opt/CAPEv2/storage/analyses/12312/files/99936e68c400365bc323cf415cf1f7c550073c38c69e7148b5a469f983a71071 - 99936e68c400365bc323cf415cf1f7c550073c38c69e7148b5a469f983a71071
/opt/CAPEv2/storage/analyses/12312/files/f445719ed100f53d19d45ccc2ff300768d89b6b5052f2fcd36e17adca7e9d48f - f445719ed100f53d19d45ccc2ff300768d89b6b5052f2fcd36e17adca7e9d48f
/opt/CAPEv2/storage/analyses/12312/files/1fd40d5753ae91c8a9ab4878c70ea593c0e0818c9a14fb497a21be9d0c19ad95 - 1fd40d5753ae91c8a9ab4878c70ea593c0e0818c9a14fb497a21be9d0c19ad95
/opt/CAPEv2/storage/analyses/12312/files/a98b37f62a1b9199619ef616b5bc522d05ab2ad8817b9349bb077b0cda13cc03 - a98b37f62a1b9199619ef616b5bc522d05ab2ad8817b9349bb077b0cda13cc03
/opt/CAPEv2/storage/analyses/12312/files/2f706dcb3dbe97a9bd11923c0524288625f465d75f074b36a76a61bbc1d91c58 - 2f706dcb3dbe97a9bd11923c0524288625f465d75f074b36a76a61bbc1d91c58
/opt/CAPEv2/storage/analyses/12312/files/df4c326c4256c276e494a48ae0cf7b8dd9d687ecccf3c322435741c351910a9e - df4c326c4256c276e494a48ae0cf7b8dd9d687ecccf3c322435741c351910a9e

Embedded URLs

http://creativecommons.org/publicdomain/zero/1.0/
http://www.adobe.com/go/reader_system_reqs_it.UnmoveFilesRimozione
http://www.adobe.com/go/reader_system_reqs_it
https://www.digicert.com/CPS0
http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
http://www.digicert.com/ssl-cps-repository.htm0
https://d.symcb.com/rpa0
http://s.symcb.com/universal-root.crl0
https://d.symcb.com/rpa0@
http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
http://mozilla.org/MPL/2.0/
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786518168&P2=404&P3=2&P4=YAskra7AsMcUclcoRhYwn%2f7Xs8o4BNBSgRMlQ%2bePvH9UShRcOZC88ROeNGS42Ye9YYc2%2bpeb%2felZAwm60y1bAg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786518241&P2=404&P3=2&P4=FmoaA74qNxr4sBWe37HmI3LTR6FdNVZffaaGweFq6krQ3nOTTRIA5zmCDvEQhyaPUOsQAvDCj5xSgq9x8bNBQw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

creativecommons.org
geocities.com
www.adobe.com
helpx.adobe.com
www.microsoft.com
crl3.digicert.com
crl4.digicert.com
www.digicert.com
cacerts.digicert.com
d.symcb.com
s.symcb.com
ts-crl.ws.symantec.com
ts-aia.ws.symantec.com
mozilla.org
piwik.documentfoundation.org

Embedded IP addresses

4.150.223.113
4.230.171.124
85.210.193.152
4.144.132.223
74.178.240.61
135.233.95.135
20.42.65.84
20.184.175.3
135.234.160.245
203.26.79.13
135.232.92.34
172.178.240.162
4.207.44.72
52.148.114.188
72.145.35.97
52.110.12.21
52.110.12.8

More Sivis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report