MALICIOUS — 50fcd3610959dc4ca6d97d41cd5b472b8d7d60671345d0c8842a3ba2ad9675f9
MALICIOUS — 50fcd3610959dc4ca6d97d41cd5b472b8d7d60671345d0c8842a3ba2ad9675f9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the Ulise family. 5 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
50fcd3610959dc4ca6d97d41cd5b472b8d7d60671345d0c8842a3ba2ad9675f9 - SHA-1:
c1e420feda2e024a41d03312521f843d067b6120 - MD5:
3dbb553ce385ea405f7d151f70da9d45 - imphash:
f119167f54171b55a9f21321e439b013 - ssdeep:
1536:Rc+gjdZzGB9bQNMeHq5ixZGLgyBmK8zccAy5mE1biojuIaWPhIgzVkQGDax2C:RcPdZ+JsaVBzQh/9hxx - TLSH:
T17A3C5BC28D077012E27BE98868197AFC4492F4AD3975814D7317C80E20F767BB97235A - Submitted as: 50fcd3610959dc4ca6d97d41cd5b472b8d7d60671345d0c8842a3ba2ad9675f9
- File type: pe · Size: 119311 bytes
- Verdict: malicious (94/100) · Family: Ulise
Detections (5 of 52 engines)
- ClamAV (daily): Win.Malware.Ulise-9886066-0
- YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): Generic.Dacic.1660.ECAF3920
- Kaspersky (KVRT): HEUR:Trojan.Win64.Agent.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Win.Malware.Ulise-9886066-0 (rule
Win.Malware.Ulise-9886066-0) - engine signal, weight 0.90, confidence 0.95 - YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule
STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: http://pm2pavba27wr4m34.onion/command.txt?sh1 - static signal, weight 0.35, confidence 0.60
- encrypt data (rule
encrypt data) - capa signal, weight 0.15, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://pm2pavba27wr4m34.onion/command.txt?sh1
Embedded domains
- pm2pavba27wr4m34.onion
More Ulise samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report