MALICIOUS — 5eb5c8deef41c47149c2d12ffbee7f78ccaeae6f8055c046f7b2258d70683a29

MALICIOUS — 5eb5c8deef41c47149c2d12ffbee7f78ccaeae6f8055c046f7b2258d70683a29 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (83/100), attributed to the ShipUp family. 4 of 25 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 5eb5c8deef41c47149c2d12ffbee7f78ccaeae6f8055c046f7b2258d70683a29
SHA-1: d25aea7f65127e8ab807cc1e0f512743e2660c6e
MD5: 1b6849bc764f44ebd0ee8ba6939a5560
imphash: 11b47caef64b54d3c3efa7c94546ad2b
ssdeep: 3072:mQchyinW3kIncLnntG/j/BJ5mTxjnw89JnszQcJdXD:mkin4kwcDtG/j/75YxF52dXD
TLSH: T11B417ABF754F6EE6E585CC22426CFB2D337DC95835C10714A83A98BF363A9A30854611
Submitted as: 5eb5c8deef41c47149c2d12ffbee7f78ccaeae6f8055c046f7b2258d70683a29
File type: pe · Size: 185872 bytes
Verdict: malicious (83/100) · Family: ShipUp

Detections (4 of 25 engines)

Kaspersky (KVRT): Trojan.Win32.ShipUp.boq
Microsoft Defender: Trojan:Win32/ShipUp!pz
Emsisoft (Emergency Kit): Trojan.Ransom.Cerber.1
Trellix Stinger (McAfee): Packed-AM!1B6849BC764F

MITRE ATT&CK

Why this verdict

The malicious score of 83/100 is the fusion of 3 weighted signals:

Dropped a malicious payload: ac67b1054168acb5bc2bb401ccf581fee9714e6e820ad5c1e23d3e4238446426 - dynamic signal, weight 0.80, confidence 0.90
Contacted 49 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

2426 behavior events · 1 ATT&CK techniques · 5 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/26485/files/ac67b1054168acb5bc2bb401ccf581fee9714e6e820ad5c1e23d3e4238446426 - ac67b1054168acb5bc2bb401ccf581fee9714e6e820ad5c1e23d3e4238446426
/opt/CAPEv2/storage/analyses/26485/files/d3d14c684db75ac98d9a034ae2800bfafa156f6d74e5933b3968813bb4f080e4 - d3d14c684db75ac98d9a034ae2800bfafa156f6d74e5933b3968813bb4f080e4
352d3c101cd0ec6bbe9ae38317f22d8a710ea082c7a7d1d79c3cce80321ab47d - 352d3c101cd0ec6bbe9ae38317f22d8a710ea082c7a7d1d79c3cce80321ab47d
810e21811e2749596905149f4b9c91d5195d7a40703182683f489ee540163bee - 810e21811e2749596905149f4b9c91d5195d7a40703182683f489ee540163bee
44f176411d7d0f984054dd9ff8f774d9d7ce8f7f6346f2c6504bf5072b1b1136 - 44f176411d7d0f984054dd9ff8f774d9d7ce8f7f6346f2c6504bf5072b1b1136

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e?P1=1786960873&P2=404&P3=2&P4=ZG3HTVTpzRrbba2fanb4Hwyi8GIpIHFJF9NDjpyK5ztwSdyXeNcn0s5xF0nrbSgN48A5dd6yA4X%2fZ9IiWgmK%2bw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/1d8d0488-0a3b-440b-b2a9-36df2b9d4ebd/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/1d8d0488-0a3b-440b-b2a9-36df2b9d4ebd?P1=1786960983&P2=404&P3=2&P4=LqGCNN3i%2bCChsa2o2kmNFmePoAo4pMTnSrzajEcB%2bf3LVjwfaoMxpufoy%2bz97LTvteW36%2bWjicOaa9NcRjIz8w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

51.105.71.137
40.84.85.40
52.253.84.76
52.123.252.241
4.230.171.124
57.154.63.210
203.26.79.13
74.178.76.128
13.89.179.12
20.112.250.133
135.233.45.222
20.165.94.63
4.150.223.111
92.223.78.30
52.110.12.25
52.110.12.5
135.232.92.34
20.165.94.54
4.150.223.108
52.148.114.188
4.150.223.98
40.103.64.242
52.123.129.14
40.99.134.2
40.104.4.2

More ShipUp samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report