MALICIOUS — 6a28ea0f9b5768d7355abd70f3d40c2eb1da063189ee93e6908f94af44c54b53

MALICIOUS — 6a28ea0f9b5768d7355abd70f3d40c2eb1da063189ee93e6908f94af44c54b53 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Bulz family. 7 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 6a28ea0f9b5768d7355abd70f3d40c2eb1da063189ee93e6908f94af44c54b53
SHA-1: ccc86bd4dd1261dd9947a3b1e6f18f009390b111
MD5: 541ec1c0db3bb5c70485161d9f7c57ac
imphash: c36eed49d8b97cc9ea6318c04a69dbb6
ssdeep: 6144:i1db49+rEg024fpLZazEjvE/rbay19tSt4bO2BaDmeBJe/ZVMXTw:ijkArEN249AyE/rbaMct4bO2/n
TLSH: T1A1462303B6BC155FC39EAC726653221FF0E6A5FFA6396710A2D081261B82453891F793
Submitted as: 6a28ea0f9b5768d7355abd70f3d40c2eb1da063189ee93e6908f94af44c54b53
File type: pe · Size: 292107 bytes
Verdict: malicious (100/100) · Family: Bulz

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Bulz-9940102-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/AutoitGenome!pz
Emsisoft (Emergency Kit): Gen:Variant.Bulz.821954
Kaspersky (KVRT): Trojan-Downloader.Win32.Agent.gpyl

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Bulz-9940102-0 (rule Win.Malware.Bulz-9940102-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/AutoitGenome!pz (rule Trojan:Win32/AutoitGenome!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Bulz.821954 (rule Gen:Variant.Bulz.821954) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Downloader.Win32.Agent.gpyl (rule Trojan-Downloader.Win32.Agent.gpyl) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 external host(s) and 30 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

28892 behavior events · 2 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61 - 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
C:\Program Files\Managemenot\Monitor\tcpscrex.exe - d6aaba6a566838845a86c3827cda0c59eb27b308a589b111d21c332e12437ffb
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\17A440B37A6A20289A68E145191710C9 - d9d9848e99895e25353b9bd9316cfeb8d1f83081e64bade95d1b182255abef27
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 - 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 - 365e2e4e777a5b012de70bc759678a6bdf705094eb5618999ad7ff879720ae06
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61 - 342efeb04a24f8ee7e254fc865a82359104cb8ece0547c34a8c713fa373da182
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3 - 59cbd02bdc70d7c771cd6f172d17da62b635276db987da2112183f3b9b944caa
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3 - 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\XRUA1FHR\getip[1].htm - 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\17A440B37A6A20289A68E145191710C9 - 634281db77c222add1cf312b6f77bd69b2b49baa3d1906550f073ace6df24848
e746177f7c73420ec5ad5be686f478768ecd038291785168865c4099838e8e9f - e746177f7c73420ec5ad5be686f478768ecd038291785168865c4099838e8e9f

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://w347302.s98.ufhosted.com/getip.asp
http://www.aamailsoft.com/getip.php
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://ye2.c.lencr.org/22.crl
http://W347302.S98.Ufhosted.Com/NC/UP/Down.txt
http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

w347302.s98.ufhosted.com
www.aamailsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
ye2.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

13.89.179.15
52.123.252.248
20.3.0.251
172.215.188.232
4.230.171.124
74.179.77.164
74.178.240.61
85.210.196.11
4.150.223.104
52.123.252.229
101.227.111.7
52.123.252.231
48.200.63.27
66.175.209.193
104.18.20.213
20.89.1.13
172.178.240.162
34.104.35.123
4.150.223.96
203.26.79.13
4.207.44.77
20.52.64.200
104.18.33.89
52.148.114.188
52.110.12.20

More Bulz samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report