MALICIOUS — 54d4eb0020db0f03774fb6e5fb2d8fe5baa10116cfdbd324d195b250353d769a

MALICIOUS — 54d4eb0020db0f03774fb6e5fb2d8fe5baa10116cfdbd324d195b250353d769a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Bublik family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 54d4eb0020db0f03774fb6e5fb2d8fe5baa10116cfdbd324d195b250353d769a
SHA-1: 3c6dce575eeeeded21ca36e33c7948d3510b9821
MD5: 151ece59ef8c1c37bf093caa5319187c
imphash: e8a152262666487600bae63a404244a1
ssdeep: 768:MiPPTYiNCSAetFpamkQzXmRItONlg8PyNUMsFYsktATb6jzUFrXJ:M0FptJiNng8dViN0m/U1
TLSH: T19D37CFCD41B81B6BC33A04E51636E95EA1DBF0E10AED351A095DA03D90C3CE3AD52E76
Submitted as: 54d4eb0020db0f03774fb6e5fb2d8fe5baa10116cfdbd324d195b250353d769a
File type: pe · Size: 74532 bytes
Verdict: malicious (100/100) · Family: Bublik

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Downloader.Upatre-10023862-0
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
Microsoft Defender: TrojanDownloader:Win32/Small.ASM!MTB
Kaspersky (KVRT): HEUR:Trojan.Win32.Bublik.pef

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Downloader.Upatre-10023862-0 (rule Win.Downloader.Upatre-10023862-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged TrojanDownloader:Win32/Small.ASM!MTB (rule TrojanDownloader:Win32/Small.ASM!MTB) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Bublik.pef (rule HEUR:Trojan.Win32.Bublik.pef) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70
Contacted 5 external host(s) and 14 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

11862 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\hromi.exe - 8f2cf71a35ad19bb80d2966a5fe9905eeca60954781b0f3ddc532e963236cdc3

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://yr.c.lencr.org/
http://yr2.c.lencr.org/110.crl
http://yr1.c.lencr.org/84.crl

Embedded domains

freedataverification.com
sellmakers.com
x1.c.lencr.org
yr.c.lencr.org
yr2.c.lencr.org
yr1.c.lencr.org

Embedded IP addresses

51.105.71.137
52.123.252.236
4.230.171.124
52.230.60.54
20.42.179.204
20.165.94.54
74.178.76.128
20.184.175.12
104.18.33.89
20.184.175.14
20.42.65.89
4.207.44.75
135.233.95.144
52.110.12.53
52.110.12.33
135.234.160.244
125.56.205.26
125.56.205.24
104.18.21.213
104.18.20.213
52.148.114.188
34.209.195.255
72.154.7.96
92.223.78.30
52.110.12.30

File paths

y:\wildlist\131227\33992ee7788627b401f8fdcea2c61a39.exe
C:\rsdov.exe
c:\c68eb46a0bd2bf83b1d505cbd8754aec.exe
C:\ybyngr.exe
C:\ibsfov.exe
C:\yxmhitsv.exe
C:\rwdan.exe
C:\34k072fY.exe
C:\xNiU1rFI.exe
C:\8uZyNj6H.exe
C:\uvSC7Del.exe
C:\LlSoZwXN.exe
C:\d33faHLj.exe
C:\73mYKaWf.exe
C:\NGARwule.exe
C:\twwtb5Yt.exe
C:\Wi7IDyMT.exe
C:\PtapgVH7.exe
C:\UnktcQEM.exe
C:\a7kfsZAn.exe
C:\Cs_Jfaeq.exe
C:\QyYmxwJs.exe
C:\3ddYvwu6.exe
C:\0gTR6SqF.exe
C:\Nd94wSWs.exe

More Bublik samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report