MALICIOUS — 8e21797e58bca613ccc6753d127360dd568cb9c1620e3c3cd7169ca182e2aaba

MALICIOUS — 8e21797e58bca613ccc6753d127360dd568cb9c1620e3c3cd7169ca182e2aaba is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Urelas family. 7 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 8e21797e58bca613ccc6753d127360dd568cb9c1620e3c3cd7169ca182e2aaba
SHA-1: e9f231ab542b65fc566876b795157edba4933ade
MD5: 1f26e98db8af0356cc1eae4bd59a6152
imphash: 5f36896d9fcb7695f7fb1ec7865dceff
ssdeep: 12288:zhDMjlZ8RZ7QwkMSiakDdUlftrIzoJ3fVR1hj8bgn8mYvTbV9rwvjlDtghOcv:5PRZAiakEfdSQhCgn85vTJ9iwOcv
TLSH: T13A53014D95F277C9D7E323346FE3985F28E61CE8C03A8D650B04E02152D16ABE8D6593
Submitted as: 8e21797e58bca613ccc6753d127360dd568cb9c1620e3c3cd7169ca182e2aaba
File type: pe · Size: 1062289 bytes
Verdict: malicious (100/100) · Family: Urelas

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.MPRESS1
ClamAV (daily): Win.Trojan.Urelas-189
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:MPRESS
Microsoft Defender: Trojan:Win32/Gupboot!pz
Emsisoft (Emergency Kit): Dropped:Generic.Urelas.C3A39B5E
Kaspersky (KVRT): Packed.Win32.Krap.ai

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Trojan.Urelas-189 (rule Win.Trojan.Urelas-189) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Gupboot!pz (rule Trojan:Win32/Gupboot!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dropped:Generic.Urelas.C3A39B5E (rule Dropped:Generic.Urelas.C3A39B5E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Packed.Win32.Krap.ai (rule Packed.Win32.Krap.ai) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MPRESS (rule DIE:MPRESS) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.MPRESS1 (rule high-entropy-sections:.MPRESS1) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
Packing/obfuscation: high-entropy-sections:.MPRESS1, MPRESS - static signal, weight 0.25, confidence 0.55
Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

24775 behavior events · 2 ATT&CK techniques · 8 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - 4b48f21a4b7a02bfbec19ef880a967a02334a3cdcef8ae83de2ef327ba8bc5dd
C:\Users\analyst\AppData\Local\Temp\jydorob.exe - 4306b41ec6359faec06550418cc3bf3b3816e07108d4bfde95b8ba0008987fa1
C:\Users\analyst\AppData\Local\Temp\jydorob.exe - 155acd08d2e3de733685837e96b810ad015c5e9d1617fc080082b1b02d1d674b
C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - a508a0c66f2cabeb74d28b69a358c029c3716bdb1fe8000c046b251a86b10c84
C:\Users\analyst\AppData\Local\Temp\~DFA3B.tmp - eb19e91b9e30a9410b41305727075eae7448652eb2ab6237127b46f3c15e7a90
C:\Users\analyst\AppData\Local\Temp\limimob.exe - 14a00fc94f0140aad6d110c491e1ecc57db2fb58396eba6e46797473e9f2e643
C:\Users\analyst\AppData\Local\Temp\gbp.ini - 4a57643d2c59d1235bc0926f845583f39345839e3e9428ad619eb4b6baf96ad2
32baa029abefdc3a2c56599edac4547e8004fcec5d7456899e847ffccac6bd66 - 32baa029abefdc3a2c56599edac4547e8004fcec5d7456899e847ffccac6bd66

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

40.79.167.9
4.230.171.124
40.84.97.4
20.165.94.54
52.253.84.76
20.184.175.7
74.178.76.128
104.18.33.89
27.125.205.36
92.223.78.30
218.54.28.146
135.234.160.245
72.145.35.98
52.110.12.18
52.110.12.33
52.148.114.188

More Urelas samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report