MALICIOUS — 3b54fc681d69d137cd371d0657455ea817f3f2e17d136e2e5c322f9535cf1f22

MALICIOUS — 3b54fc681d69d137cd371d0657455ea817f3f2e17d136e2e5c322f9535cf1f22 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Urelas family. 5 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 3b54fc681d69d137cd371d0657455ea817f3f2e17d136e2e5c322f9535cf1f22
SHA-1: dd918aeac9b3656dd76db36e56f72fe0c7864c0b
MD5: 0a9118d695b79adbd4d2a6c5cf54bec8
imphash: e77246b3d14bf4cc4fcd12f0ba31740f
ssdeep: 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpomH7:PMpASIcWYx2U6hAJQni
TLSH: T1F24ACF69C2F2A389EBF797302E549E0E20E25CDDD0BF4D984383C15D62D299BD1D112A
Submitted as: 3b54fc681d69d137cd371d0657455ea817f3f2e17d136e2e5c322f9535cf1f22
File type: pe · Size: 460023 bytes
Verdict: malicious (98/100) · Family: Urelas

Detections (5 of 55 engines)

ClamAV (daily): Win.Trojan.Urelas-9635181-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Urelas!pz
Trellix Stinger (McAfee): Corrupt-FY!0A9118D695B7
Kaspersky (KVRT): HEUR:Backdoor.Win32.Plite.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Trojan.Urelas-9635181-0 (rule Win.Trojan.Urelas-9635181-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 1.234.83.146, 133.242.129.155, 218.54.31.226 - static signal, weight 0.35, confidence 0.60
Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

30260 behavior events · 2 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\pivog.exe - a75467e2ad71aa5c49f696b1086cfd933ca2da9daafe7e591c6a65eeafa23495
C:\Users\analyst\AppData\Local\Temp\pivog.exe - 02e1b96ef42b3136b29eefeeb62bb9f8176c064eff9c4628da2ed466d0264398
C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - 5acffc2d07e0266dd716170a4bdec2085769711277269e0030c4812795a6f17f
C:\Users\analyst\AppData\Local\Temp\opcybe.exe - 0eedaac0268d4bfc497e7044f638774d3359f64b1f745a4b7b5441c36eaa595c
C:\Users\analyst\AppData\Local\Temp\lojos.exe - d195c13d01e0d9c6659e84544914a98e0cdc4d23a5aea74aca7f0888db4dd13d
145dbe674b068fd38392610cf7f354f44e7710270550be03ba80bb3820ebef62 - 145dbe674b068fd38392610cf7f354f44e7710270550be03ba80bb3820ebef62

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787892062&P2=404&P3=2&P4=XfnNKWd6%2fvJMGfKA3NczyHsrqCdnoMCmo8CMf8RpGqngKeTIRcQQr%2fzx8mdC3rd%2bU7%2b%2fDQJXWOtfKWEM4S0Esg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787892090&P2=404&P3=2&P4=dJoP%2fN7QDcfpR9a%2bW8Ot93QD7tPd1N06Q5PBuPO0hYb7lxe8k2VPQDEzEGzByNuDB4YHgqPnhuQ1ELyMvhXrhw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165
20.184.175.16
20.247.184.197
4.230.171.124
4.247.188.233
20.165.94.63
4.150.223.102
74.178.240.51
20.42.65.84
20.231.239.246
52.123.129.14
52.123.128.14
203.26.79.13
135.232.92.34
52.123.252.223
135.234.160.246
85.210.193.152
20.184.175.22
20.184.175.15
52.148.114.188
172.178.240.161
72.145.35.99

More Urelas samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report