MALICIOUS — 8050b7efa6acfce72620eab155061465ba81b9b8d5a65e284495c37d9c5718be

MALICIOUS — 8050b7efa6acfce72620eab155061465ba81b9b8d5a65e284495c37d9c5718be is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Container family. 9 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 8050b7efa6acfce72620eab155061465ba81b9b8d5a65e284495c37d9c5718be
SHA-1: 43b82184a89cf2a250d42b7b9ffe9a75f8b1ba2a
MD5: 0fb8925f3090774d139cfbb54069acb9
imphash: 38aa7c2ff6ef0e48a9520d6702d08df4
ssdeep: 768:41uAkERoZtpcVK2Eq3GcOnzlpuCUtblllU:40nERoZtEEq3GcOzlwlU
TLSH: T1ED330A5B2220E52FD4E0998B040DFD7D88C615F89F714183A694F6F484B8C7BA61FB89
Submitted as: 8050b7efa6acfce72620eab155061465ba81b9b8d5a65e284495c37d9c5718be
File type: pe · Size: 52052 bytes
Verdict: malicious (100/100) · Family: Container

Detections (9 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Agent-6943819-1
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Trellix Stinger (McAfee): PolyPatch-UPX
Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-6943819-1 (rule Win.Trojan.Agent-6943819-1) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Sivis.A (rule Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PolyPatch-UPX (rule PolyPatch-UPX) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Agent.es (rule Virus.Win32.Agent.es) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.55, confidence 0.70
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/ - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

18542 behavior events · 0 ATT&CK techniques · 97 dropped files.

Dropped files

C:\Program Files\7-Zip\Lang\fur.txt - cebad5db6cd26902b97c857b33ee2d5cd205e68ae786e58ff57778c2661dfc51
C:\Program Files\7-Zip\Lang\ca.txt - 3b52fa53cfa5bad8baab68ae7fb8fb95b5a3cbf178c4338cee65dcc7e0bc274e
C:\Program Files\7-Zip\Lang\ast.txt - 30476beb4fb9df3b5e84f542e4e0c7ee7ca2e49f7942e0edc40f5c1b649330a7
C:\Program Files\7-Zip\Lang\pt-br.txt - 0b487eb12a51681b89381c6a1946bcc006f3b93b965671e393a6917c51962cf6
C:\Program Files\7-Zip\Lang\ku-ckb.txt - 448a895491cf578fe3b876a6bdd0f099497987c03e04db49cacbe497ad64863d
C:\Program Files\7-Zip\Lang\nb.txt - 009764378dcb3a253fff8154890316ec1763df1fbfce4434083ec450a72fcf52
C:\Program Files\7-Zip\Lang\gl.txt - 9ccc574c48b669c4c6aae5be0cd18571e13b71372325f571d93a33809c3bad51
C:\Program Files\7-Zip\7-zip.dll - d524d20942b9bdaa59ccdd86bc0de95584f2cc4c525f41d3ec3203b2d53b2391
C:\Program Files\7-Zip\Lang\fr.txt - 03742ea3e8f2e5f23f954ead81c2e061908f1413638d144375e4844683926f09
C:\Program Files\7-Zip\Lang\ru.txt - 8f920f686bb0608e8fd9d48a27452cde24d42d8c7230410d5053fdf59e72609b
C:\$WinREAgent\Rollback.xml - b5a98f9fb02449eace399e8d22746a0c9ce23151b81941e616cb15dd372f3994
C:\Program Files\7-Zip\Lang\mng2.txt - af48ebcff1a1589a6b40f274543c6e39b7f54768c0fe8ce0ebf30d0ab98d50e6
C:\Program Files\7-Zip\Lang\ne.txt - 66a49892d90e6a11a33d409fafc746958f6bd50c4d2c2f90fdfa0996ac42ae5e
C:\Program Files\7-Zip\7z.exe - bbaa6f7d16eba6da84e41e3f38454eb3a2854fe23bc8e2c2708dcb608b08d1e7
a7948c65a4763ab9d57f6bac574c022b7e64414f76a7bd7b8aec3438c856f636 - a7948c65a4763ab9d57f6bac574c022b7e64414f76a7bd7b8aec3438c856f636

Embedded URLs

http://creativecommons.org/publicdomain/zero/1.0/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

creativecommons.org

Embedded IP addresses

4.150.223.112
52.230.59.222
52.123.252.233
4.230.171.124
20.165.94.54
57.154.63.210
135.232.92.137
51.116.253.170
20.42.73.24
104.208.16.94
172.178.240.162
52.110.12.3
52.110.12.51

File paths

X:\windows\system32\sysreset.exe
C:\Windows.old\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
C:\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1120_none_c3e
C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1_none_eedfed
X:\SysResetTrace-Tel-Merge.etl,
C:\$WINDOWS.~BT\Sources\Panther\SysResetTrace-Tel-Merge.etl)
C:\Users\Public\Desktop\LibreOffice

More Container samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report