MALICIOUS — 873f7b14dd1c11f5fc3d34d951b2f6c78c3d1b09d599277dad2d1c9c919f6571

MALICIOUS — 873f7b14dd1c11f5fc3d34d951b2f6c78c3d1b09d599277dad2d1c9c919f6571 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the 1C8613B1 family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 873f7b14dd1c11f5fc3d34d951b2f6c78c3d1b09d599277dad2d1c9c919f6571
SHA-1: 81fd7819c57f563176b3d03d1b4d30f94681ec30
MD5: 1cc0bd66a2d9c8d906304c5a42bf7e83
imphash: 0d52988c17b6d0ad679318ef76f1e151
ssdeep: 3072:Y/I2cKfZvFXHfmlDsco+Wf+J8xbvxTo7:YwTKxvFXHfO1oKJiQ
TLSH: T1C13D5CD29D037461E03AD9886C2476FC8493F8AE3975814D632BC94E10F757BB87236A
Submitted as: 873f7b14dd1c11f5fc3d34d951b2f6c78c3d1b09d599277dad2d1c9c919f6571
File type: pe · Size: 133637 bytes
Verdict: malicious (100/100) · Family: 1C8613B1

Detections (5 of 56 engines)

ClamAV (daily): Win.Malware.Ulise-9886066-0
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Generic.Dacic.1660.1C8613B1
Kaspersky (KVRT): HEUR:Trojan-Ransom.Win32.Cryptoff.vho

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Ulise-9886066-0 (rule Win.Malware.Ulise-9886066-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in tsk_3b4955daab (pid 7248) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Generic.Dacic.1660.1C8613B1 (rule Generic.Dacic.1660.1C8613B1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-Ransom.Win32.Cryptoff.vho (rule HEUR:Trojan-Ransom.Win32.Cryptoff.vho) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70
Contacted 12 external host(s) and 53 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://pm2pavba27wr4m34.onion/command.txt?sh1f - static signal, weight 0.35, confidence 0.60
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

1956 behavior events · 1 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\cached-consensus - a8a36a1a75b87725d6fc6b4fb4baf460016ddd0f7e93e1eb2132fc0b39a76b67

Embedded URLs

http://pm2pavba27wr4m34.onion/command.txt?sh1f
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788152783&P2=404&P3=2&P4=YSy%2fImypmDYVVpheI0IbNINf6S%2bjgPZ9Mg%2bRWkf3SbvnkBiQ%2fSw9eLSQ1q9c67AVf0YantIN4KgAI%2bJRzbfhAA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://131.188.40.189/tor/status-vote/current/consensus
http://204.13.164.118/tor/server/fp/a30c7006422806cbf18196c51024af70f2f43bd1
http://193.23.244.244/tor/server/fp/42fa86d718adfc6ca8ddb5dae83d608223c09494
http://216.218.219.41/tor/server/fp/9cd27f3cb8e44e1f54fa907b0d271b5a9d22f252
http://216.218.219.41/tor/server/fp/9cf224ca8a67aa4eb4f1f4cf2dd8a8b216a399bc
http://204.13.164.118/tor/server/fp/9cf906c179a29a1beb1e04dc201252d1bffece3d
http://204.13.164.118/tor/server/fp/d85573b35052a1349105abf70f698157dbafac4b
http://193.23.244.244/tor/server/fp/d856155f4a1dccb37a5ea5301eb78579ea26f756
http://193.23.244.244/tor/server/fp/d856977c28257ec70df937b2cb06e8ac98940613
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://193.23.244.244/tor/server/fp/d416f7c8d83cad913f3e09320014170d54fe6aa0
http://193.23.244.244/tor/server/fp/646b4e39b49f303b4b552a8f3cbb8fcd40be7eb5
http://193.23.244.244/tor/status-vote/current/consensus
http://204.13.164.118/tor/server/fp/d08660b6d70b6249a57d89bb7a8f2ea2c952bd35
http://193.23.244.244/tor/server/fp/8f4c1d95d01018af300a0c91a94f33231bec97af

Embedded domains

pm2pavba27wr4m34.onion
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

104.46.162.231
4.230.171.124
40.79.167.9
74.178.240.61
85.210.193.152
74.179.77.164
74.178.76.128
52.230.60.54
20.184.175.18
154.35.175.225
52.123.252.193
135.232.92.34
203.26.79.13
4.150.223.108
131.188.40.189
204.13.164.118
193.23.244.244
216.218.219.41
162.210.173.17
20.42.179.192
52.110.12.2
52.110.12.16
92.223.78.30
171.25.193.79
130.89.149.57

More 1C8613B1 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report