MALICIOUS — 74af8be31421ec608c634e21bf999afa451c92d3573aaf4ab5873ba2cf32a99b

MALICIOUS — 74af8be31421ec608c634e21bf999afa451c92d3573aaf4ab5873ba2cf32a99b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Bulz family. 7 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 74af8be31421ec608c634e21bf999afa451c92d3573aaf4ab5873ba2cf32a99b
SHA-1: 0fc55d463e976502205bd51433d0dd7686decad8
MD5: ca696771a17b41ccd53e056719aef4fd
imphash: c36eed49d8b97cc9ea6318c04a69dbb6
ssdeep: 6144:b1db49+rEg024fpLZazEjvE/rbay19tSt4bO2BaDmeBJe/ZVMXTw:bjkArEN249AyE/rbaMct4bO2/n
TLSH: T1B4462303B6BC155FC39EBC726653221FF0E6A5FFA6396710A2D081261B82453891F793
Submitted as: 74af8be31421ec608c634e21bf999afa451c92d3573aaf4ab5873ba2cf32a99b
File type: pe · Size: 292107 bytes
Verdict: malicious (100/100) · Family: Bulz

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Bulz-9940102-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/AutoitGenome!pz
Emsisoft (Emergency Kit): Gen:Variant.Bulz.821954
Kaspersky (KVRT): Trojan-Downloader.Win32.Agent.gpyl

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Malware.Bulz-9940102-0 (rule Win.Malware.Bulz-9940102-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/AutoitGenome!pz (rule Trojan:Win32/AutoitGenome!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Bulz.821954 (rule Gen:Variant.Bulz.821954) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Downloader.Win32.Agent.gpyl (rule Trojan-Downloader.Win32.Agent.gpyl) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 external host(s) and 24 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

28529 behavior events · 2 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61 - 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 - 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 - db2dc4488ad3e1bffb042d76fbda1b1fb27f01de8813334f9896a67f36867fc2
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3 - 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\17A440B37A6A20289A68E145191710C9 - 3b070c5f6234326df6afe3649e5c5e18fc3b2158db9e4d51bade4271c3af9805
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\17A440B37A6A20289A68E145191710C9 - 5a5fa43b767ab4054e5bec0f23a3ef2a19a711a53b893a8b2cf920a41e2fbc5c
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61 - a35f08e42d3190344db1d896b732a4abc329abbc770fbb1e3945edadade7e229
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\XRUA1FHR\getip[1].htm - 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3 - 41e36dc508c74fb2f92d2ab49eac676d646332a0f4708a4da99108396ca619d8
C:\Program Files\Managemenot\Monitor\tcpscrex.exe - 75d4bfbc1b8e32788a34cb6b192335cf7aa711398caa410513976232849bb3a6
3987be11c97579757fb4363f6a1f3154f77b5fa5ad80e4834f04ac74fd509028 - 3987be11c97579757fb4363f6a1f3154f77b5fa5ad80e4834f04ac74fd509028

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://w347302.s98.ufhosted.com/getip.asp
http://www.aamailsoft.com/getip.php
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://ye2.c.lencr.org/22.crl
http://W347302.S98.Ufhosted.Com/NC/UP/Down.txt
http://c.pki.goog/r/r1.crl
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

w347302.s98.ufhosted.com
www.aamailsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
ye2.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.20
52.230.60.54
52.123.252.212
4.230.171.124
172.64.154.167
101.227.111.7
66.175.209.193
104.18.21.213
52.110.12.38
52.110.12.31
135.233.45.221
85.210.193.152
4.207.44.66
72.145.35.103
52.168.117.174
52.148.114.188
52.110.12.15
52.110.12.33

More Bulz samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report