MALICIOUS — 3cec48496dd6b96259ed7dd7b0376ac780536f1054427dab0b549bf8c1c71bd6

MALICIOUS — 3cec48496dd6b96259ed7dd7b0376ac780536f1054427dab0b549bf8c1c71bd6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sivis family. 9 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 3cec48496dd6b96259ed7dd7b0376ac780536f1054427dab0b549bf8c1c71bd6
SHA-1: 5b6d45968e25b2343ee3114b30419c39b25f98ab
MD5: b8aa56cdcec393910a2fe214e92434d9
imphash: 38aa7c2ff6ef0e48a9520d6702d08df4
ssdeep: 6144:TeEriRsAxH/K2jye9POln4RUOeinwl5gaO5W2cRFtnWR9/:igixH/dpPOV4uOeinggFQFtWX/
TLSH: T1934A9FB2111A1135D9FAAEB0A01CCE7CD0637949703C6F5E9087EB5C90E86D7E8FA491
Submitted as: 3cec48496dd6b96259ed7dd7b0376ac780536f1054427dab0b549bf8c1c71bd6
File type: pe · Size: 439953 bytes
Verdict: malicious (100/100) · Family: Sivis

Detections (9 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Agent-6943819-1
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX 3.91
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Trellix Stinger (McAfee): PolyPatch-UPX
Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-6943819-1 (rule Win.Trojan.Agent-6943819-1) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Sivis.A (rule Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PolyPatch-UPX (rule PolyPatch-UPX) - engine signal, weight 0.55, confidence 0.85
Contacted 33 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:UPX 3.91 (rule DIE:UPX 3.91) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX, UPX 3.91 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

25474 behavior events · 1 ATT&CK techniques · 97 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/12477/files/8975acb954506ef09d047a54e36e7e6b7abb80bc56e423486dfa1b4121d9de32 - 8975acb954506ef09d047a54e36e7e6b7abb80bc56e423486dfa1b4121d9de32
/opt/CAPEv2/storage/analyses/12477/files/95ccaabf6eac7a4582cc33e60b78e4eb1b61caf4b934c1cd82c4a50e04154d0d - 95ccaabf6eac7a4582cc33e60b78e4eb1b61caf4b934c1cd82c4a50e04154d0d
/opt/CAPEv2/storage/analyses/12477/files/0c4ed496a2258e515c8265c6817a01ed6c9853538e0ce3b11dbd7a9494f8261c - 0c4ed496a2258e515c8265c6817a01ed6c9853538e0ce3b11dbd7a9494f8261c
/opt/CAPEv2/storage/analyses/12477/files/6a278886c8b6ea35cd3d220c535625e3a3aec0a70fe18f3b6597ee8282ac9922 - 6a278886c8b6ea35cd3d220c535625e3a3aec0a70fe18f3b6597ee8282ac9922
/opt/CAPEv2/storage/analyses/12477/files/9ba2461ec35f32211531ef0a4740ef45e507b7f69956b0c66c96041ac0e71695 - 9ba2461ec35f32211531ef0a4740ef45e507b7f69956b0c66c96041ac0e71695
/opt/CAPEv2/storage/analyses/12477/files/270838eda4d3d83f55b21a462922703c02e848967c59faaca1b13a8ffbda1f9e - 270838eda4d3d83f55b21a462922703c02e848967c59faaca1b13a8ffbda1f9e
/opt/CAPEv2/storage/analyses/12477/files/5f8039da1a4392cb557f7fd70533e3bf5d3d0d060a018e81c698d5c724c1d0b7 - 5f8039da1a4392cb557f7fd70533e3bf5d3d0d060a018e81c698d5c724c1d0b7
/opt/CAPEv2/storage/analyses/12477/files/0c08e6f8fefe37034c614ae2049fb62622059e6003229f617d7d0930baa26994 - 0c08e6f8fefe37034c614ae2049fb62622059e6003229f617d7d0930baa26994
/opt/CAPEv2/storage/analyses/12477/files/7a5f2cc1abed5ecfa0e1a79cf4a95f3630a55d2b93f34a2af3f40026be38a961 - 7a5f2cc1abed5ecfa0e1a79cf4a95f3630a55d2b93f34a2af3f40026be38a961
/opt/CAPEv2/storage/analyses/12477/files/ebc8f4b4f2ab6422fde4bd296fddab9f539e43b122b9a069d858bedf5f9e04d6 - ebc8f4b4f2ab6422fde4bd296fddab9f539e43b122b9a069d858bedf5f9e04d6
/opt/CAPEv2/storage/analyses/12477/files/44787ed4785f07ea4f0bd222f5cb8f5e9804bd8e3fc5e05ebe96fcafe1c99b8a - 44787ed4785f07ea4f0bd222f5cb8f5e9804bd8e3fc5e05ebe96fcafe1c99b8a
/opt/CAPEv2/storage/analyses/12477/files/d9fb1b0ada74d91d2c71b87e5fd0898b4729fa00714221bda4f0b4085cdfd761 - d9fb1b0ada74d91d2c71b87e5fd0898b4729fa00714221bda4f0b4085cdfd761
/opt/CAPEv2/storage/analyses/12477/files/b345d2d48bbe7f941a4b8ba90f82b5d5cffbb9572159dafc1b9d26770108618f - b345d2d48bbe7f941a4b8ba90f82b5d5cffbb9572159dafc1b9d26770108618f
/opt/CAPEv2/storage/analyses/12477/files/259eb94c6618732c9159fbbbfcd02241ff9688782020a287a183a7728eb6d555 - 259eb94c6618732c9159fbbbfcd02241ff9688782020a287a183a7728eb6d555
/opt/CAPEv2/storage/analyses/12477/files/ea52bc202b2ead735359dd3d124a1377c13350b496a86aa2a3749168143ba993 - ea52bc202b2ead735359dd3d124a1377c13350b496a86aa2a3749168143ba993

Embedded URLs

http://creativecommons.org/publicdomain/zero/1.0/
http://www.adobe.com/go/reader_system_reqs_it.UnmoveFilesRimozione
http://www.adobe.com/go/reader_system_reqs_it
https://www.digicert.com/CPS0
http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
http://www.digicert.com/ssl-cps-repository.htm0
https://d.symcb.com/rpa0
http://s.symcb.com/universal-root.crl0
https://d.symcb.com/rpa0@
http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786523421&P2=404&P3=2&P4=WhTtOyxxxLtz%2bm%2fmyDN5dtF0TOeF6M6%2bfDGDo%2bD7DOzsbEGgqRvBxalkgCMJgSJXNSXZoB5LQSre1wC1uSKYgg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786523451&P2=404&P3=2&P4=LeV3qfPbIFwMdwsTD2uucFhWwUmnjsfS3MlOzNzYpWidaOVUcdDLM6Zw9YR2B8j0i8IDNNc9gOrqyWYmo8cXQg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

creativecommons.org
geocities.com
www.adobe.com
helpx.adobe.com
www.microsoft.com
crl3.digicert.com
crl4.digicert.com
www.digicert.com
cacerts.digicert.com
d.symcb.com
s.symcb.com
ts-crl.ws.symantec.com
ts-aia.ws.symantec.com

Embedded IP addresses

4.150.223.98
4.247.188.224
4.144.132.223
48.211.4.16
4.230.171.124
104.208.16.94
74.178.76.128
74.178.240.51
51.116.253.169
135.233.45.223
20.165.94.46
203.26.79.13
135.234.160.245
57.154.63.210
52.148.114.188
72.145.35.108
52.110.12.31
52.110.12.24

More Sivis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report