MALICIOUS — 2ee651e0be560c8a3b2cc3c0ba7d66d3632a449c34f9ab698024f7b7e269d278

MALICIOUS — 2ee651e0be560c8a3b2cc3c0ba7d66d3632a449c34f9ab698024f7b7e269d278 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Sivis family. 9 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 2ee651e0be560c8a3b2cc3c0ba7d66d3632a449c34f9ab698024f7b7e269d278
SHA-1: b0b5dbca1bf8c540bf027c1edf4e423500d4fd81
MD5: ea870805ef2806440804fc7508d3ae0a
imphash: 38aa7c2ff6ef0e48a9520d6702d08df4
ssdeep: 6144:TeEriRsAxH/K2jye9POln4RUOeinwl5gaO5W2cRF+:igixH/dpPOV4uOeinggFQF+
TLSH: T1AB498EB2011A1135D9FAAEB0A41CCE7CD0637949703C6F5E9087EB5C90D8AD3E8FA495
Submitted as: 2ee651e0be560c8a3b2cc3c0ba7d66d3632a449c34f9ab698024f7b7e269d278
File type: pe · Size: 410278 bytes
Verdict: malicious (99/100) · Family: Sivis

Detections (9 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Agent-6943819-1
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Trellix Stinger (McAfee): PolyPatch-UPX
Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-6943819-1 (rule Win.Trojan.Agent-6943819-1) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 4 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Contacted 25 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Dropped 83 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

25520 behavior events · 0 ATT&CK techniques · 97 dropped files.

Dropped files

C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-crt-private-l1-1-0.dll - 8c5215f75130ae129849658bb8d43293cdae73bf313486e53369d1b72557e7a1
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-crt-process-l1-1-0.dll - 2a68bdf28147f277dffe95f463f375677ddb4ab2afaf65d5ec347370ef89320f
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-core-localization-l1-2-0.dll - 2d400c5a8cd427330026466c311ca83c1c92ce03ba1a25822973f39b788c48b3
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jawt.dll - fd84da387801ac70bbd54e1c33c2b63171ee954bcb327a486fe9b24847a02314
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-core-file-l1-2-0.dll - 06ffeebe831458836b71ccf01f3da1583c9fdff69abac71cde88b6dc38200d04
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\management_agent.dll - fc8aa4888d334b572e9be6e3ff4442028a6e4e406de46f0ef6bda8c33d6c9008
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.dll - 9ea2fecc33930e7e094641b54a0539468363322eb5bda526635e27fe7ed102c8
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-core-fibers-l1-1-0.dll - 6d52d1f2c73fd69ee6a1ee4f7584fc515ab7d1ee0e64bd10294994b3c4906e5c
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-crt-convert-l1-1-0.dll - 514425c19736d3d52e70b76f0cdf8d6dd18d520d825a2172d5fd0dd807d0605f
c21b6548b8d14c80fc50a19b756235a986ddd13c764ae4a89433efee13e92ac2 - c21b6548b8d14c80fc50a19b756235a986ddd13c764ae4a89433efee13e92ac2
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll - c0087b225f4b0a93a84fe44983386d520d29fe8f782359ed930d36758f2bb04c
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-core-synch-l1-2-0.dll - dc7bb4746de218d92e655ac61b31238542f4f8bd00e7833dc82ec5a0ccc5e528
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jdwp.dll - 28c530b5830c9316bf8d3d536adff74e88e5728604546758ff9a987110c0453c
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll - 5951f451795fa674257bc6076254b4a6879e4c06bda348d25257af7884d485cb
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-core-processthreads-l1-1-1.dll - 5b9baa6acb76ea016cdc2b380c72a3b5857436b3465f83e85c19320489be32a4

Embedded URLs

http://creativecommons.org/publicdomain/zero/1.0/
http://www.adobe.com/go/reader_system_reqs_it.UnmoveFilesRimozione
http://www.adobe.com/go/reader_system_reqs_it
https://www.digicert.com/CPS0
http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
http://www.digicert.com/ssl-cps-repository.htm0
https://d.symcb.com/rpa0
http://s.symcb.com/universal-root.crl0
https://d.symcb.com/rpa0@
http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787769462&P2=404&P3=2&P4=TJHUkcgTwmMYoXCkZmBBbgqBl4wM2xyluzVGsmEkN402uGxgswqjWqckQgfuUNA42mw8BHE%2fBMaSE5YgB5OQ9g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787769556&P2=404&P3=2&P4=msPbubL1VGjIbXL2q8rysvR0kuuddrfy1AyOXjs23NsdWGrdpCWuGfkHB6HAX%2fCVF8xsJlsNYmsU7XkgSRmLFA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

creativecommons.org
geocities.com
www.adobe.com
helpx.adobe.com
www.microsoft.com
crl3.digicert.com
crl4.digicert.com
www.digicert.com
cacerts.digicert.com
d.symcb.com
s.symcb.com
ts-crl.ws.symantec.com
ts-aia.ws.symantec.com

Embedded IP addresses

13.89.179.15
172.215.188.232
20.247.185.124
4.230.171.124
57.155.104.224
74.178.240.61
4.150.223.100
135.233.95.135
52.123.129.14
20.231.239.246
40.99.134.18
52.178.17.235
135.233.45.221
203.26.79.13
162.159.142.9
52.123.252.225
74.178.232.29
52.123.252.245
52.123.252.204
52.148.114.188
135.234.160.245
72.145.35.108
142.250.195.163
52.110.12.25
52.110.12.20

More Sivis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report