MALICIOUS — 55988cdd02203fa690737b6e6aca99ae0aeaff42ae0807ede503918304a182f7

MALICIOUS — 55988cdd02203fa690737b6e6aca99ae0aeaff42ae0807ede503918304a182f7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AddUser family. 8 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 55988cdd02203fa690737b6e6aca99ae0aeaff42ae0807ede503918304a182f7
SHA-1: 57e395947ccf65279604312b366b0b4ffb7f33cc
MD5: 0e06bce34dbff2467ae8a92756302e71
imphash: 68864e2c52b98624974843d1b22a695b
ssdeep: 12288:CzCr6D+2OkeG9F1xk1kwZRo5FbDFBQX6f6AkdIAELARixZFDuW:Cza2OkeG9jxyTo5Fbz/zkOLLARixXDuW
TLSH: T1A24A23D806A6B310E1FA3777DB48D98D10D165F3686D203512C7532FA2F609BAE5A323
Submitted as: 55988cdd02203fa690737b6e6aca99ae0aeaff42ae0807ede503918304a182f7
File type: pe · Size: 441284 bytes
Verdict: malicious (100/100) · Family: AddUser

Detections (8 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): ASPack
ClamAV (daily): Win.Malware.Ulise-9806872-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:ASProtect SKE 2.72+
LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: Trojan:Win32/Tonmye!pz
Kaspersky (KVRT): HEUR:Trojan.Win32.AddUser.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Malware.Ulise-9806872-0 (rule Win.Malware.Ulise-9806872-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (AddUser): 1491ee21bb6c4ea324ebd14b0819818229ad9b3f69ab0a148d284cd71d287305 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Tonmye!pz (rule Trojan:Win32/Tonmye!pz) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.AddUser.gen (rule HEUR:Trojan.Win32.AddUser.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 35 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:ASProtect SKE 2.72+ (rule DIE:ASProtect SKE 2.72+) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.360.cn, http://www.eyuyan.com, http://www.360.cn/ - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: ASPack, high-entropy-sections:.text, ASProtect SKE 2.72+, ASPack 2.12-2.42 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

29511 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/9549/files/1491ee21bb6c4ea324ebd14b0819818229ad9b3f69ab0a148d284cd71d287305 - 1491ee21bb6c4ea324ebd14b0819818229ad9b3f69ab0a148d284cd71d287305
/opt/CAPEv2/storage/analyses/9549/files/32ccc22f51a810d76698c5475abfe1990454871ccb52d2854bac7aa616ed2a83 - 32ccc22f51a810d76698c5475abfe1990454871ccb52d2854bac7aa616ed2a83
cf4b7f777d5ed8a1f601cee85abcbed541df68e1e3c0e7c52c3f368df78dd616 - cf4b7f777d5ed8a1f601cee85abcbed541df68e1e3c0e7c52c3f368df78dd616
992053dba5da5c29e4e32c98500a4da9e8691f2d4f6e8af22fca02a3ef682d78 - 992053dba5da5c29e4e32c98500a4da9e8691f2d4f6e8af22fca02a3ef682d78

Embedded URLs

http://crl.verisign.com/tss-ca.crl0
https://www.verisign.com/rpa
https://www.verisign.com/rpa0
https://www.verisign.com/cps0*
http://logo.verisign.com/vslogo.gif0
http://crl.verisign.com/pca3.crl0
http://www.360.cn
http://www.eyuyan.com
http://www.360.cn/
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786421774&P2=404&P3=2&P4=PfgVvozMmCO8Q2l20CA1mx3VQExVT1a5NPhW1t92%2bZvP5y7o%2b%2bbLJrVmSx1L61ioLPmGVDZMkQMXggcl0j291w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786421864&P2=404&P3=2&P4=mR2QyfGcsGs3DNFIX98ovfYnrBBaM0OS1HqgB3b43nO33cUQbF9H7MXA923pTM1bYx1MiMicDuYSe75c3UkDrA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.verisign.com
www.verisign.com
csc3-2009-2-crl.verisign.com
csc3-2009-2-aia.verisign.com
logo.verisign.com
www.360.cn
www.eyuyan.com

Embedded IP addresses

4.150.223.115
20.247.185.124
4.247.188.233
4.230.171.124
135.233.95.144
20.165.94.54
52.168.117.168
135.234.160.245
135.234.160.246
203.26.79.13
92.223.78.30
74.178.76.44
172.178.240.163
20.42.179.192
4.150.223.101
52.168.117.171
72.145.35.98
52.148.114.188
74.179.71.159
52.110.12.20
52.110.12.44

More AddUser samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report