MALICIOUS — 5efb4eba5af64c35db26f48b72a4bbc53c2d6ae5a0bd4ff3420278e63d2a22d9

MALICIOUS — 5efb4eba5af64c35db26f48b72a4bbc53c2d6ae5a0bd4ff3420278e63d2a22d9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Ulise family. 8 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 5efb4eba5af64c35db26f48b72a4bbc53c2d6ae5a0bd4ff3420278e63d2a22d9
SHA-1: d0e29d3fda6864ce457bdf81d0dabfb6037a2304
MD5: 3035a2b128ea9339e138c7892721f310
imphash: a5491ddab3ab64c1c40fad74c1ea58b8
ssdeep: 49152:dqgazxcGYN139lnk30raxpFkoXhS5Ty8N4DTqyJRGu:dqgazxc5H39ln2NqqheF6TJD
TLSH: T1375D12661F3F3A13EA31C6B4F616AFAE44B3E515C337B80C90E6351E82D588B662054D
Submitted as: 5efb4eba5af64c35db26f48b72a4bbc53c2d6ae5a0bd4ff3420278e63d2a22d9
File type: pe · Size: 2794794 bytes
Verdict: malicious (100/100) · Family: Ulise

Detections (8 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
ClamAV (daily): Win.Malware.Ulise-9786791-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_VMProtect
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Tiggre!rfn
Emsisoft (Emergency Kit): Gen:Variant.Genie.59
Kaspersky (KVRT): HEUR:Trojan.Win32.Kryptik.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Ulise-9786791-0 (rule Win.Malware.Ulise-9786791-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Tiggre!rfn (rule Trojan:Win32/Tiggre!rfn) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Genie.59 (rule Gen:Variant.Genie.59) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Kryptik.gen (rule HEUR:Trojan.Win32.Kryptik.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_Packer_VMProtect (rule YR_Packer_VMProtect) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Themida/VMProtect (rule Themida/VMProtect) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Themida/VMProtect, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

93 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
update.googleapis.com
login.live.com
desktop-hsgcbep
v20.events.data.microsoft.com
config.edge.skype.com
windows.msn.com
www.msn.com
officeclient.microsoft.com
odc.officeapps.live.com
licensing.mp.microsoft.com
assets.msn.com
www.bing.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
www.msftconnecttest.com/connecttest.txt

Dropped files

C:\Program Files (x86)\gyfkdlx\r.exe - 1951c59607fce9f99d23a06a880b91847c6c6d49cdba97e6be4d483a452f8afc

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

4.150.223.108
20.247.184.142
4.230.171.124
52.110.12.26
52.110.12.18

File paths

C:\=hC

More Ulise samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report