MALICIOUS — 5a6e9b0f1bb0778f65c50f21f62aae500086d92bcec752fb1f2f0b46694abb35

MALICIOUS — 5a6e9b0f1bb0778f65c50f21f62aae500086d92bcec752fb1f2f0b46694abb35 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sivis family. 9 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 5a6e9b0f1bb0778f65c50f21f62aae500086d92bcec752fb1f2f0b46694abb35
SHA-1: 77cf915d35401ea5bc533d5bb05eca5013276bec
MD5: 73444dbdaad868a3dac7baf91ba9e9ac
imphash: 38aa7c2ff6ef0e48a9520d6702d08df4
ssdeep: 6144:TeEriRsAxH/K2jye9POln4RUOeinwl5gaO5W2cRFO:igixH/dpPOV4uOeinggFQFO
TLSH: T15F498EB2011A1135D9FAAEB0A41CCE7CD0637949703C6F5E9087EB5C90D8AD3E8FA495
Submitted as: 5a6e9b0f1bb0778f65c50f21f62aae500086d92bcec752fb1f2f0b46694abb35
File type: pe · Size: 410105 bytes
Verdict: malicious (100/100) · Family: Sivis

Detections (9 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Agent-6943819-1
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX 3.91
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Trellix Stinger (McAfee): PolyPatch-UPX
Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-6943819-1 (rule Win.Trojan.Agent-6943819-1) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 6 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 1152) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Virus:Win32/Sivis.A (rule Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PolyPatch-UPX (rule PolyPatch-UPX) - engine signal, weight 0.55, confidence 0.85
Contacted 33 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:UPX 3.91 (rule DIE:UPX 3.91) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX, UPX 3.91 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

25478 behavior events · 1 ATT&CK techniques · 97 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/12456/files/b9a0562d1c79436e6f53725a56a8ec27700c05defffd8897fdf81b5a1e087f55 - b9a0562d1c79436e6f53725a56a8ec27700c05defffd8897fdf81b5a1e087f55
/opt/CAPEv2/storage/analyses/12456/files/0dfc443faa948d7b6d1a0fe8a9a1e54dcb0224d41d1b4b91f593b1cd16ce0037 - 0dfc443faa948d7b6d1a0fe8a9a1e54dcb0224d41d1b4b91f593b1cd16ce0037
/opt/CAPEv2/storage/analyses/12456/files/b015cc3ccf637541a21f783e7e27bf2b6e3e909fffca04b58681e030d6d3cf77 - b015cc3ccf637541a21f783e7e27bf2b6e3e909fffca04b58681e030d6d3cf77
/opt/CAPEv2/storage/analyses/12456/files/5d9e1e72a657f9c1104e2b8ad3ca8d6c63cfd75e8ed4301b56aa688a626f7f32 - 5d9e1e72a657f9c1104e2b8ad3ca8d6c63cfd75e8ed4301b56aa688a626f7f32
/opt/CAPEv2/storage/analyses/12456/files/6e3aab442aecc16051a26c439d24eaead8f7b04a81e8ef3969fe886ec622ab53 - 6e3aab442aecc16051a26c439d24eaead8f7b04a81e8ef3969fe886ec622ab53
/opt/CAPEv2/storage/analyses/12456/files/46afd1cd099219eb30e25a61b84f521a27168e688bcfdeb0a42bc094e258402d - 46afd1cd099219eb30e25a61b84f521a27168e688bcfdeb0a42bc094e258402d
/opt/CAPEv2/storage/analyses/12456/files/233fa18da627ecc124873ae50c0a39c1392e4f2fbdb40e6e91147e27e1e38e4b - 233fa18da627ecc124873ae50c0a39c1392e4f2fbdb40e6e91147e27e1e38e4b
/opt/CAPEv2/storage/analyses/12456/files/116cebcab4a014f9e6200605a8711e7c2c8b64acb67c3b1b91b5362ee2685f4a - 116cebcab4a014f9e6200605a8711e7c2c8b64acb67c3b1b91b5362ee2685f4a
/opt/CAPEv2/storage/analyses/12456/files/3c120c3d826a2a0a19ffc6c0de08df99a5da94f38786dbacd39699ef4a05035c - 3c120c3d826a2a0a19ffc6c0de08df99a5da94f38786dbacd39699ef4a05035c
/opt/CAPEv2/storage/analyses/12456/files/3a5d5bfb7475a2755ea100dcfa55255406933a319969904873d59458865af30e - 3a5d5bfb7475a2755ea100dcfa55255406933a319969904873d59458865af30e
/opt/CAPEv2/storage/analyses/12456/files/37160b11ce431bf4b1ca59c6d2682fa54165eb4d07aa5cae432dc1ce72a0d08a - 37160b11ce431bf4b1ca59c6d2682fa54165eb4d07aa5cae432dc1ce72a0d08a
/opt/CAPEv2/storage/analyses/12456/files/72bbab4787ca098e758874ee368c981472e699ac3b06c3a49f5d3e2e36b9d369 - 72bbab4787ca098e758874ee368c981472e699ac3b06c3a49f5d3e2e36b9d369
/opt/CAPEv2/storage/analyses/12456/files/1421de43dde3774f7f7d40ef3ef5be5a9189e8c4db98fc03993cf74e39342403 - 1421de43dde3774f7f7d40ef3ef5be5a9189e8c4db98fc03993cf74e39342403
/opt/CAPEv2/storage/analyses/12456/files/b16a67c236c41afaf67b9079c04d034465852ac2f5d739312a95a7b2d24d33b1 - b16a67c236c41afaf67b9079c04d034465852ac2f5d739312a95a7b2d24d33b1
/opt/CAPEv2/storage/analyses/12456/files/3959a9d020b609966c639ae8bd86fe1a8557efea5a1f8c2c3712de99cf0b5d61 - 3959a9d020b609966c639ae8bd86fe1a8557efea5a1f8c2c3712de99cf0b5d61

Embedded URLs

http://creativecommons.org/publicdomain/zero/1.0/
http://www.adobe.com/go/reader_system_reqs_it.UnmoveFilesRimozione
http://www.adobe.com/go/reader_system_reqs_it
https://www.digicert.com/CPS0
http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
http://www.digicert.com/ssl-cps-repository.htm0
https://d.symcb.com/rpa0
http://s.symcb.com/universal-root.crl0
https://d.symcb.com/rpa0@
http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786522789&P2=404&P3=2&P4=HsCJN%2fl3ylVb9%2fNuE3CQBkKs1r9QOdw9zdiqzkuIjHsvmdLI51dIAgCHPy%2bd4nkg06Nx7%2brChl1uxVfCImanJw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786522846&P2=404&P3=2&P4=P2LJ9u8vT4VG47f6PkHvTySCM02pI1hB5WZblsE59drlrNar0d8l0IAeiq%2fbUMztUe%2fAhug%2bpuXdwJSIM2YITw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

creativecommons.org
geocities.com
www.adobe.com
helpx.adobe.com
www.microsoft.com
crl3.digicert.com
crl4.digicert.com
www.digicert.com
cacerts.digicert.com
d.symcb.com
s.symcb.com
ts-crl.ws.symantec.com
ts-aia.ws.symantec.com

Embedded IP addresses

20.184.175.23
20.42.179.192
4.230.171.124
20.247.184.142
74.178.76.128
20.184.175.0
74.178.76.54
4.150.223.100
135.234.160.244
20.165.94.46
203.26.79.13
52.123.252.204
135.233.45.221
172.66.2.5
52.148.114.188
74.178.76.44
72.153.5.63
52.110.12.50

More Sivis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report