MALICIOUS — 5f026c2b627a9ea450aaa29f9ee805195a3a00246ab6d5cea5ce9a0c8ff14879

MALICIOUS — 5f026c2b627a9ea450aaa29f9ee805195a3a00246ab6d5cea5ce9a0c8ff14879 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Upatre family. 7 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 5f026c2b627a9ea450aaa29f9ee805195a3a00246ab6d5cea5ce9a0c8ff14879
SHA-1: 6de5fbc942b02db96386add7b053905d29494add
MD5: 50840a162b7bad53a6bd30b6c21784bd
imphash: d462694bd082cc9c8a155ef70e182588
ssdeep: 768:PHrWYzwyQkfhL4srp+KZprr61/7DeUzJLjvJNUoEf7D:fCYsDWhL40USrG1GUzJLjvJNw7D
TLSH: T11433EACD40E80F7AC23610F16631EA5E92D7B0D20AAC791A4D9E507D80C38B39D96E76
Submitted as: 5f026c2b627a9ea450aaa29f9ee805195a3a00246ab6d5cea5ce9a0c8ff14879
File type: pe · Size: 51144 bytes
Verdict: malicious (100/100) · Family: Upatre

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.MPRESS1
ClamAV (daily): Win.Dropper.Upatre-7391283-0
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:MPRESS
Microsoft Defender: TrojanDownloader:Win32/Upatre.AK
Emsisoft (Emergency Kit): GenPack:Generic.Nymaim.E.76646E0B
Kaspersky (KVRT): Trojan.Win32.Agent.landbf

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Dropper.Upatre-7391283-0 (rule Win.Dropper.Upatre-7391283-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged TrojanDownloader:Win32/Upatre.AK (rule TrojanDownloader:Win32/Upatre.AK) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged GenPack:Generic.Nymaim.E.76646E0B (rule GenPack:Generic.Nymaim.E.76646E0B) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.landbf (rule Trojan.Win32.Agent.landbf) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MPRESS (rule DIE:MPRESS) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.MPRESS1 (rule high-entropy-sections:.MPRESS1) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
Packing/obfuscation: high-entropy-sections:.MPRESS1, MPRESS - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

10189 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\koekuky.exe - 1338e216d42552237315cc7d7b8e97b1d2d2b894c1c738ef6a53923114979727
1736031a647fa9570c07a15965e06f2583a6ce29d1f8173ecc425e212498d300 - 1736031a647fa9570c07a15965e06f2583a6ce29d1f8173ecc425e212498d300
21fea51bcd623d372d1b23b376ca821dba0fd99338c5345d85eae0788f5d2ec0 - 21fea51bcd623d372d1b23b376ca821dba0fd99338c5345d85eae0788f5d2ec0

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

51.116.246.105
52.123.252.242
4.230.171.124
20.42.179.192
20.247.184.197
135.232.92.137
74.178.240.51
4.150.223.96
172.64.154.167
52.110.12.2
52.110.12.54
52.178.17.2
135.233.45.221
20.42.179.204
72.145.35.110
52.148.114.188
52.110.12.33

File paths

C:\Users\john\AppData\Local\Temp\9D467D412FA86CC827D53DA14FB23446.exe
C:\268b897269d77acc5da1b9f5818b3d7ba38a55914935403bc626f0ad877fc15a
C:\8f4541eec6d1a449b49e182008e5564ab78586d3e8ae44f3524d21f5d886a283
C:\Documents
C:\Users\admin\Downloads\471b85b8cad34d2f1ddcc164dca79c8426ac05a3c6d797271ca388d436b5d956.exe
C:\bb02f4d9e3d434dca91c146f015e4db9b0f8d871f82c3f89ea015abe44a64a9d
C:\Users\admin\Downloads\koekuky.exe
C:\2b49872793166b7b21e4cd9faa2c88773342c732c993537e6948824197c4525c
C:\Users\Petra\AppData\Local\Temp\koekuky.pe32
C:\39f2e893e47f866734bdd007ae1d873e28048a01e88aa0fd03376746a97d0768
C:\f14a6e44752d72fcb5fef103e3b87343544ee865fb09431e0b493cf5e2ad5719
C:\Users\admin\Downloads\05f765f14665083d04a2eff6d6d5ec61b97acd200e34a72d985f18364b0b758b.exe
C:\Users\admin\Downloads\2a2909842c701864_koekuky.exe
C:\bd9743cc67f60c647e29e6764026235adc9dce2ffdab8c01159d4b6a2afbbb9a
C:\894752525ab16cb64ec948d46af6f1b93e6d39df9bb48a56e69a52ecb3255af9
C:\278988e9d7444f3b88a35b0826ea1c4ea70fc12b7e47a357c77a08992d619364
C:\fc963c28281ac421445da799a11d6489e087868a9e786e03c157fe77c584759a
C:\Users\admin\Downloads\124a32597477708e_koekuky.exe
C:\4e6860f098675e3744a9a3a1abf5c2cb9af691ffc3de53950156b191f4e1671a
C:\562930a149345f6e0e837a01c5ea4940cf67b24d97987b452c0ed85e203e7569
C:\7a3154eb9a62f60fa5ffd16f3fd1156872ba8cddcd5d449fa7e396536a5d5def
C:\Users\admin\Downloads\357b93032f9c82ce_koekuky.exe
C:\922d4d3d4cd4a1fe2c3bbf9ce36bc9c77c77da19ccee3ece59eb8d7f5af1d927
C:\a292fc8fb3238e6b40dc678ea6f83ed2d16a986c00f976e5c768b1f027996061
C:\bae8553b7fd95d3dcc14d0cb7e88cfa9fe983f1ef4511086ed7a4bd5acdfcbee

More Upatre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report