MALICIOUS — 4b98fd2b3aa291405a6310c6d2263c360c6bd93b43c516f1265f0f34e8e567a7

MALICIOUS — 4b98fd2b3aa291405a6310c6d2263c360c6bd93b43c516f1265f0f34e8e567a7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Bulz family. 7 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 4b98fd2b3aa291405a6310c6d2263c360c6bd93b43c516f1265f0f34e8e567a7
SHA-1: e149fcc4a103538a039c7ccb0216497dec05e555
MD5: 57516e6a5e0c21bc3f6ca7e78ada5c64
imphash: c36eed49d8b97cc9ea6318c04a69dbb6
ssdeep: 6144:51db49+rEg024fpLZazEjvE/rbay19tSt4bO2BaDmeBJe/ZVMXTw:5jkArEN249AyE/rbaMct4bO2/n
TLSH: T16C462303B6BC155FC39EAC726613221FF0E6A5FFA6396710A2D081261B82453891F793
Submitted as: 4b98fd2b3aa291405a6310c6d2263c360c6bd93b43c516f1265f0f34e8e567a7
File type: pe · Size: 292107 bytes
Verdict: malicious (100/100) · Family: Bulz

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Bulz-9940102-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/AutoitGenome!pz
Emsisoft (Emergency Kit): Gen:Variant.Bulz.821954
Kaspersky (KVRT): Trojan-Downloader.Win32.Agent.gpyl

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Bulz-9940102-0 (rule Win.Malware.Bulz-9940102-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/AutoitGenome!pz (rule Trojan:Win32/AutoitGenome!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Bulz.821954 (rule Gen:Variant.Bulz.821954) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Downloader.Win32.Agent.gpyl (rule Trojan-Downloader.Win32.Agent.gpyl) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

29307 behavior events · 2 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 - f952c89ade444dfb5d9b30353ca4f5ee6d1dfea463f8590e608cdd9a202e8cbd
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61 - 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 - 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61 - 5aff16454e00b3e39043dd421f47e4f69ee7dadd36ef0b141b05d449c01a2596
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3 - 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
C:\Program Files\Managemenot\Monitor\tcpscrex.exe - ddb515cf48abd8f29d9938ff7119e18313d00cbb5bdbbfe25137d5a1f633aa83
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3 - acf36aa21aa651952d9cd05c8dadc637b82ede06e4fcbb4fcfd5b6325f6c5997
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\XRUA1FHR\getip[1].htm - 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\17A440B37A6A20289A68E145191710C9 - ac47560052da4d32cffa8b85aacea7438e0f67fe38c4174e1c620fd9ca606f7b
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\17A440B37A6A20289A68E145191710C9 - 38e6a169af5f2c69ace0d1b818d9cd212f02c5c4f380678ab82404d6d1a1a99c
776d18aac9f165ee792d33f566a56df11500b6ca705bedf6f10f919c925f6d3a - 776d18aac9f165ee792d33f566a56df11500b6ca705bedf6f10f919c925f6d3a

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://w347302.s98.ufhosted.com/getip.asp
http://www.aamailsoft.com/getip.php
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://ye2.c.lencr.org/22.crl
http://W347302.S98.Ufhosted.Com/NC/UP/Down.txt

Embedded domains

w347302.s98.ufhosted.com
www.aamailsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
ye2.c.lencr.org

Embedded IP addresses

20.42.73.30
52.123.252.233
52.230.60.54
4.230.171.124
104.18.33.89
101.227.111.7
66.175.209.193
104.18.21.213
20.42.179.192
172.178.240.163
20.42.179.204
72.154.7.97
52.148.114.188
52.110.12.8
52.110.12.30

More Bulz samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report