MALICIOUS — 8c2c534554155a319b8dae070407560ef3940d69efc64eabc3c90df0366dfd5a

MALICIOUS — 8c2c534554155a319b8dae070407560ef3940d69efc64eabc3c90df0366dfd5a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Unruy family. 5 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 8c2c534554155a319b8dae070407560ef3940d69efc64eabc3c90df0366dfd5a
SHA-1: 0901084a2b16275927d02eec11e9ec2ea59088dd
MD5: 1092ac0e79a49ebdf10f48f7f70fbaca
imphash: 53b338a5a343440770be2403e59415fb
ssdeep: 6144:Om6UslMOSw0vk4S/N7V1U5za49e5MQFEoHx5tzeTq50o+vPsd/kZN6mO3ePtJ4fC:OmDslrzwe5AOftTl+V6T2R8E9e0
TLSH: T1144AA0261A1A7F34D72F3F256865E70FBB034A3FA1ED212212504B1A791915FE7C122A
Submitted as: 8c2c534554155a319b8dae070407560ef3940d69efc64eabc3c90df0366dfd5a
File type: pe · Size: 449268 bytes
Verdict: malicious (99/100) · Family: Unruy

Detections (5 of 56 engines)

ClamAV (daily): Win.Downloader.Unruy-6988793-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: TrojanDownloader:Win32/Unruy!pz
Emsisoft (Emergency Kit): Gen:Variant.Zusy.298612
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Downloader.Unruy-6988793-0 (rule Win.Downloader.Unruy-6988793-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged TrojanDownloader:Win32/Unruy!pz (rule TrojanDownloader:Win32/Unruy!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Zusy.298612 (rule Gen:Variant.Zusy.298612) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 5968) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

396 behavior events · 0 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\microsoft\OneDrive\onedrive.exe - 7d36f56c15a8ff5ba5b9060b1e187cd213fff176486596a5eecba4a848f22368
C:\program files (x86)\Adobe\acrotray .exe - f6104483ca860949be67a3d846711962198511391306eb40034c7e1204d1950e
C:\program files (x86)\Adobe\acrotray.exe - 02a372e521751b87f60a7c8859a341fdd1406dd584165d9c7a2e5be73d055b1d
C:\program files (x86)\internet explorer\wmpscfgs.exe - 1cec9ba5cc67b43dfc68ea98aabfc3be3ba571afc650a411ce36cf75c9f543a7
69cac0777572e336e8c7c15c5663a99e2308bdf36934f5b19fb853cd8baba5a3 - 69cac0777572e336e8c7c15c5663a99e2308bdf36934f5b19fb853cd8baba5a3

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

4.207.44.66
52.123.252.213
4.230.171.124
4.144.132.223
57.154.63.210
135.232.92.97
20.42.73.25
74.178.240.61
20.165.94.63
135.234.160.246
52.110.12.44
52.110.12.38

More Unruy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report