MALICIOUS — 45c1d1e3473b0132fc927ecdc39e907cbe08f1b2bb221e72560eff1146632d21

MALICIOUS — 45c1d1e3473b0132fc927ecdc39e907cbe08f1b2bb221e72560eff1146632d21 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the 1C8613B1 family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 45c1d1e3473b0132fc927ecdc39e907cbe08f1b2bb221e72560eff1146632d21
SHA-1: f06e2735134f8ad06ee688e5c4fc13a1a966bdc6
MD5: 2cc4924e016a502cca717b7e0206cdc3
imphash: 0d52988c17b6d0ad679318ef76f1e151
ssdeep: 3072:Y/I2cKfZvFXHfmlDsco+Wf+J8xbvxTop:YwTKxvFXHfO1oKJiY
TLSH: T17D3D5CD29D037461E03AD9886C2476FC8493F8AE3975814D632BC94E10F757BB87236A
Submitted as: 45c1d1e3473b0132fc927ecdc39e907cbe08f1b2bb221e72560eff1146632d21
File type: pe · Size: 133642 bytes
Verdict: malicious (100/100) · Family: 1C8613B1

Detections (5 of 56 engines)

ClamAV (daily): Win.Malware.Ulise-9886066-0
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
Microsoft Defender: Trojan:Win32/Ymacco!pz
Emsisoft (Emergency Kit): Generic.Dacic.1660.1C8613B1
Kaspersky (KVRT): HEUR:Trojan-Ransom.Win32.Cryptoff.vho

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Ulise-9886066-0 (rule Win.Malware.Ulise-9886066-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Memory forensics: 2 finding(s) attributed to the sample across 2 technique(s), e.g. RWX/private injected region in tsk_514edc6a79 (pid 8836) (rule windows.malfind.Malfind) - memory signal, weight 0.65, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Ymacco!pz (rule Trojan:Win32/Ymacco!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Generic.Dacic.1660.1C8613B1 (rule Generic.Dacic.1660.1C8613B1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-Ransom.Win32.Cryptoff.vho (rule HEUR:Trojan-Ransom.Win32.Cryptoff.vho) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70
Contacted 11 external host(s) and 45 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://pm2pavba27wr4m34.onion/command.txt?sh1f - static signal, weight 0.35, confidence 0.60
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

2094 behavior events · 1 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\cached-consensus - f9ffcad4649e630693b7b8a32f2b1f09fdf7c1d23daa6797f3873817eac95c88

Embedded URLs

http://pm2pavba27wr4m34.onion/command.txt?sh1f
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://128.31.0.39:9131/tor/status-vote/current/consensus
http://216.218.219.41/tor/server/fp/05da862f1c1c692df1432197e94318518582d495
http://216.218.219.41/tor/server/fp/5c60154e9671b1b7139f847ae6fba41daa0a8abb
http://204.13.164.118/tor/server/fp/ac9d89e7a99b7f95e115be6d5d219d4196b09790
http://204.13.164.118/tor/server/fp/acaae1708144f6485aaffd59c3c6eaa1ea4aaab2
http://216.218.219.41/tor/server/fp/acb898b28acabbd78f23af2fb06fc864a4111646
http://216.218.219.41/tor/server/fp/8eae810fa33f26341605d59f82d8ad58f7ea6cc5
http://204.13.164.118/tor/server/fp/8ec879f5955ad3db5c13bca686ee5967469b909c
http://204.13.164.118/tor/server/fp/8eccba855814f6369d3efdbd02fc6bf5ab258b03
http://204.13.164.118/tor/server/fp/dbe833b67eef0bddd2131e162d9491943c4546ec
http://204.13.164.118/tor/server/fp/3407c5cf6a78ba476bf17ae20635f4b22a00cb17
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://131.188.40.189/tor/status-vote/current/consensus
http://204.13.164.118/tor/server/fp/d856977c28257ec70df937b2cb06e8ac98940613
http://204.13.164.118/tor/server/fp/8194cc9055278ce5bb426411fadb5c4fc51e55fd
http://216.218.219.41/tor/server/fp/ac9d89e7a99b7f95e115be6d5d219d4196b09790
http://216.218.219.41/tor/server/fp/acaae1708144f6485aaffd59c3c6eaa1ea4aaab2
http://204.13.164.118/tor/server/fp/acb898b28acabbd78f23af2fb06fc864a4111646
http://204.13.164.118/tor/server/fp/f5e913dc367be76c4ccfaeb5bdf7500c04afdb25
http://216.218.219.41/tor/server/fp/6624e6e0c57a63b686d45150787dd56c3d9ee8a8

Embedded domains

pm2pavba27wr4m34.onion

Embedded IP addresses

13.89.179.12
52.230.59.222
4.230.171.124
135.233.95.135
4.150.223.97
74.179.77.204
20.42.179.192
52.123.252.226
82.94.251.203
52.123.252.218
104.18.33.89
128.31.0.39
216.218.219.41
204.13.164.118
52.110.12.24
52.110.12.14
138.249.133.62
4.150.223.96
192.96.218.133
131.188.40.189
192.129.217.25
72.145.35.110
23.129.64.175
52.148.114.188
52.110.12.44

More 1C8613B1 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report