MALICIOUS — 771261ef6bf9c7f46d3f186c7d1dba15481acd189e7d3d22a3d8449d1567c748

MALICIOUS — 771261ef6bf9c7f46d3f186c7d1dba15481acd189e7d3d22a3d8449d1567c748 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Ulise family. 8 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 771261ef6bf9c7f46d3f186c7d1dba15481acd189e7d3d22a3d8449d1567c748
SHA-1: bd14c4e32fb9859eb7e1177dc4035030e319c09e
MD5: f5c3cbf073212def98aa6b4831498641
imphash: 68864e2c52b98624974843d1b22a695b
ssdeep: 12288:CzCr6D+2OkeG9F1xk1kwZRo5FbDFBQX6f6AkdIAELARixZFDuy:Cza2OkeG9jxyTo5Fbz/zkOLLARixXDuy
TLSH: T1944A23D806A6B310E1FA3777DB48D98D10D165F3686D203512C7532FA2F609BAE5A323
Submitted as: 771261ef6bf9c7f46d3f186c7d1dba15481acd189e7d3d22a3d8449d1567c748
File type: pe · Size: 441276 bytes
Verdict: malicious (100/100) · Family: Ulise

Detections (8 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): ASPack
ClamAV (daily): Win.Malware.Ulise-9806872-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:Microsoft Linker
LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: Trojan:Win32/Tonmye!pz
Kaspersky (KVRT): HEUR:Trojan.Win32.AddUser.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Ulise-9806872-0 (rule Win.Malware.Ulise-9806872-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.360.cn, http://www.eyuyan.com, http://www.360.cn/ - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: ASPack, high-entropy-sections:.text, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

28200 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\Microsoft\svchcst.exe - 8c81c9105a6df82c9b7d98cf45f5a3c131360a49fbb5274d0052f843b4f75776
C:\Users\analyst\AppData\Roaming\Microsoft\VBS3.vbs - 5d13d374c85c28bfbf9b639752c1436aabb1e5084ccb51c537a2721a8c84b0d3
07fb03763ec72224f397e659225e5f5d1bdb7974f974e98a7002ed09da038a9d - 07fb03763ec72224f397e659225e5f5d1bdb7974f974e98a7002ed09da038a9d
d4e44ccf2e8f5400f2496e03e199b989a7a2991bd0f08b63cd57da547e165843 - d4e44ccf2e8f5400f2496e03e199b989a7a2991bd0f08b63cd57da547e165843

Embedded URLs

http://crl.verisign.com/tss-ca.crl0
https://www.verisign.com/rpa
https://www.verisign.com/rpa0
https://www.verisign.com/cps0*
http://logo.verisign.com/vslogo.gif0
http://crl.verisign.com/pca3.crl0
http://www.360.cn
http://www.eyuyan.com
http://www.360.cn/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787732549&P2=404&P3=2&P4=UaiXFt9ZaQxo%2fUXSA3UVBQip5YH4KRRS6kzYWN2iXW5Wqaq0p3T8D%2bED4LHO7UB5Af6BB4SET62zlbCqfgQDgA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787732616&P2=404&P3=2&P4=mEziUXHHFSo5%2fW98rq1o%2fEZZdO8kV0Jvg%2fQM%2bGrpVn4WKQiizOd%2fFIkeVy5SqJBmV%2brVE33HRx0moPYbC3kvtw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.verisign.com
www.verisign.com
csc3-2009-2-crl.verisign.com
csc3-2009-2-aia.verisign.com
logo.verisign.com
www.360.cn
www.eyuyan.com

Embedded IP addresses

203.26.79.13
51.116.253.168
52.123.252.202
52.253.84.76
57.155.101.212
4.230.171.124
135.233.95.144
20.184.175.20
74.178.240.51
20.236.44.162
40.103.64.242
52.123.129.14
52.123.128.14
162.159.142.9
172.178.240.161
74.178.76.44
135.234.160.246
52.123.252.203
52.148.114.188
74.179.71.159
52.110.12.15
92.223.78.30
20.184.175.10
4.150.223.103
142.251.42.99

More Ulise samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report