MALICIOUS — 6dc3b02c2f99714baef7dadbe3012f0df2c1433059a99180c733a9f57eb0d2f3

MALICIOUS — 6dc3b02c2f99714baef7dadbe3012f0df2c1433059a99180c733a9f57eb0d2f3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sivis family. 8 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 6dc3b02c2f99714baef7dadbe3012f0df2c1433059a99180c733a9f57eb0d2f3
• SHA-1: b4cd24e84dcc1c71dbca02289f26053dee0959d6
• MD5: 7e383805b3b19010266e672d2c7a08d3
• imphash: 38aa7c2ff6ef0e48a9520d6702d08df4
• ssdeep: 3072:NnEOtEEq1LaTCZiIljikMTmAcThAkZThMTMz6UFhNGpWU:TeE8LaTCZi8ixTmAcThAkZThMTM7FhNO
• TLSH: T1FD3F4C5F2120D92ED1D08A5B190CE5BE9CC3D5688A71864252CCF6B8847C83F772FBA5
• Submitted as: 6dc3b02c2f99714baef7dadbe3012f0df2c1433059a99180c733a9f57eb0d2f3
• File type: pe · Size: 161696 bytes
• Verdict: malicious (100/100) · Family: Sivis

Detections (8 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): Win.Trojan.Agent-6943819-1
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Detect It Easy (packer/type): DIE:UPX
• Microsoft Defender: Virus:Win32/Sivis.A
• Emsisoft (Emergency Kit): Win32.Sivis.A
• Trellix Stinger (McAfee): PolyPatch-UPX
• Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

• T1105

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Agent-6943819-1 (rule Win.Trojan.Agent-6943819-1) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Virus:Win32/Sivis.A (rule Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged PolyPatch-UPX (rule PolyPatch-UPX) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Virus.Win32.Agent.es (rule Virus.Win32.Agent.es) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
• Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
• MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, https://www.gnu.org/software/automake/manual/automake.html, http://fsmsh.com/2753 - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
• Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
• Extracted generic config (5 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

18818 behavior events · 0 ATT&CK techniques · 97 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• ctldl.windowsupdate.com
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• settings-win.data.microsoft.com
• www.bing.com

Dropped files

• C:\Program Files\7-Zip\Lang\kk.txt - 387890b102416dc2cfde7634954b543b7cf5c32e577009a2942e0f3a3cabdbb1
• C:\$WinREAgent\Backup\boot.sdi - cc2032491c02e90bfcbd3ecd275e76306721fab2e61cf0d92d3e8ec14c44c767
• C:\Program Files\7-Zip\Lang\gl.txt - c2a718b8ba2c142c3faf8e77d554dde5f12fac93d7e3472d339cc580f53f56ab
• C:\Program Files\7-Zip\Lang\ja.txt - 612749ddee47d510c8ba5242498d3643dc66d11dad12501f3906bbb30e8281d0
• C:\Program Files\7-Zip\Lang\be.txt - c901badf420217de1a3ea9bf0f1a96e19c2cc3bc9e58356583fb29fc49ed993a
• C:\Program Files\7-Zip\Lang\da.txt - 80d03d0c8067abbe205d4c064323de1b4701f0b1999bf69dfa11042ea1405b6e
• C:\Program Files\7-Zip\7-zip.dll - 3f39d2b1d1216d630b10b982b8d90ef4d318f14467df9f331694c3fc35715aae
• C:\Program Files\7-Zip\7zG.exe - 5d5fdba513686e950768dae12f7bb9515a894c9d525502a3233e13aec21a3d45
• C:\Program Files\7-Zip\Lang\az.txt - f4a8139629d65c2cb5b2ffce3d1ef79fb87aa29b85e0175bbef61e46988f4096
• C:\Program Files\7-Zip\Lang\ms.txt - f55abb2e5e7bc123a0fe281a5a96d65b8e9543b6e3898f58bc7df5052c79ad20
• C:\Program Files\7-Zip\7-zip.chm - 7abc42332a5464362b0d24d7cf218d659196e0dc305835e46ad493922209bec7
• C:\Program Files\7-Zip\Lang\ar.txt - 81006fe53888301db003158c40eec61817e40c7919930e1a770858f0eff59a0c
• C:\Program Files\7-Zip\Lang\kaa.txt - b5d4e1c38e05c206ab1857fb096d5bff3eb2aec91102a9abb367c39065af69d4
• C:\Program Files\7-Zip\Lang\ast.txt - cbe0f0f66be87f6200f691ce1dbaa1959168dd67218cd004a8963d03d6ba9eb2
• C:\Program Files\7-Zip\Lang\af.txt - dbae7f08d8d7bec284922796ee53f896bcc3f2b074314c6954fc681acb283a11

Embedded URLs

• http://creativecommons.org/publicdomain/zero/1.0/
• https://www.gnu.org/software/automake/manual/automake.html
• http://fsmsh.com/2753
• https://autotools.io/index.html
• http://miller.emu.id.au/pmiller/books/rmch/
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/

Embedded domains

• debian.org
• creativecommons.org
• geocities.com
• www.gnu.org
• fsmsh.com
• autotools.io
• miller.emu.id.au
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 2.7.6.1
• 20.50.201.205
• 52.123.252.202
• 40.84.85.40
• 20.247.185.124
• 85.210.193.152
• 135.233.95.144
• 135.233.95.135
• 20.42.65.90
• 4.230.171.124
• 52.110.12.45
• 135.233.45.221
• 52.110.12.28
• 20.42.72.131
• 52.110.12.53
• 52.110.12.8

File paths

• X:\windows\system32\sysreset.exe
• C:\Windows.old\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
• C:\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
• C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1120_none_c3e
• C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1_none_eedfed
• X:\SysResetTrace-Tel-Merge.etl,
• C:\$WINDOWS.~BT\Sources\Panther\SysResetTrace-Tel-Merge.etl)
• C:\Windows.old
• C:\.
• C:\Windows.old\Windows\System32\Config\Software.
• C:\\Windows\System32\Config\Software.

More Sivis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report