MALICIOUS — a02191c48c77f45165a963403cfaa9f80be6e0a2c3f57cabf649da18cf1b5abc

MALICIOUS — a02191c48c77f45165a963403cfaa9f80be6e0a2c3f57cabf649da18cf1b5abc is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sivis family. 8 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: a02191c48c77f45165a963403cfaa9f80be6e0a2c3f57cabf649da18cf1b5abc
• SHA-1: 1cf8d9aabcd6018829be19c9b904405bc5114e73
• MD5: 0040557732bd699715b03ba5984cf1c1
• imphash: b10d16eedb1085ef7262dfc4ab03be6f
• ssdeep: 6144:KEq0E/MrEFMFnJkQCa4ixTmAcThAkZThMTMI:KAEFMFnRCpix1c60yh
• TLSH: T1BE436CCD1114CB1BC2398A2B3C94D6FE1EC3F4B425F0B5290758937A946983B6D1A2F9
• Submitted as: a02191c48c77f45165a963403cfaa9f80be6e0a2c3f57cabf649da18cf1b5abc
• File type: pe · Size: 240406 bytes
• Verdict: malicious (100/100) · Family: Sivis

Detections (8 of 56 engines)

• capa (capabilities): capability:execution/powershell
• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): Win.Malware.Genpack-9875154-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Detect It Easy (packer/type): DIE:UPX
• Microsoft Defender: Virus:Win32/Sivis.A
• Emsisoft (Emergency Kit): Win32.Sivis.A
• Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

• T1059.001
• T1105

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

• ClamAV (daily) flagged Win.Malware.Genpack-9875154-0 (rule Win.Malware.Genpack-9875154-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Virus:Win32/Sivis.A (rule Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Virus.Win32.Agent.es (rule Virus.Win32.Agent.es) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• Contacted 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
• Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
• capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
• MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, http://www.gnu.org/licenses/, https://www.gnu.org/software/automake/manual/automake.html - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
• Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
• Extracted generic config (4 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

19016 behavior events · 0 ATT&CK techniques · 98 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• ctldl.windowsupdate.com
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• settings-win.data.microsoft.com
• licensing.mp.microsoft.com
• config.edge.skype.com
• windows.msn.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com

Dropped files

• C:\Program Files\7-Zip\Lang\nb.txt - 6fcedb71a3f20a189eda0c6430d0c7e830386e622c0d7e05f18cb73cde2c0816
• C:\Program Files\7-Zip\Lang\bn.txt - dc30203044375040aaa69a7cc5178704f479ce7e9d3c38cf4d913c0e47111ef5
• C:\Program Files\7-Zip\Lang\nl.txt - 169a4324d19e1885f38446ecba6ceb3a392e105a3dea9968833a4f7cdad1b55e
• C:\Program Files\7-Zip\Lang\ba.txt - 58e9a9dba0f8834c7c699a61ca937617578702edb289070d4668581176a5727f
• C:\PPLFaultTemp\EventAggregationPH.dll - 9a5a8c28c2e6e5c4cb8b33f4eb2264753576db34cbffee43b2b6f68905d02b92
• C:\Program Files\7-Zip\Lang\hr.txt - 46955bd21598320c1859b984dbb5c12a1cfb59cc81ce56c07fa297b58c0c3f08
• C:\Program Files\7-Zip\Lang\kaa.txt - 7a1f8bbe412b9a2af4e94e4dcf07240dbbde81e3f193f571e71db9d7319db58b
• C:\Program Files\7-Zip\7z.dll - 261679b781ae59ebea68d5b1d25949daa075ac7dc0c343fddc4b9e219d16615a
• C:\Program Files\7-Zip\7zFM.exe - 1fe042499d1e42a712a60968bc4a1639416ee6f2cba3af79f5bf3bdc3e9c4bae
• C:\Program Files\7-Zip\Lang\ku-ckb.txt - 410167415e6327a5a356a2e44288211182bd653f3de25df27192676fb294a6ee
• C:\p.ps1 - 3a835328e3b334b2e7740d74d889cb8c84b5a8b7ee11c48cc069fa55e1e40b85
• C:\Program Files\7-Zip\Lang\pt-br.txt - e3aa66d371eb68c392f8420730494dda5a36515c4b70d5223195ff6b0ef1c24d
• C:\Program Files\7-Zip\Lang\ast.txt - 26e3d5afa60b2662c79341a894b46e577a9d7f54e1e3ba9ecce1828ac4febc01
• C:\Program Files\7-Zip\Lang\ky.txt - 08be5871c1133a620b79a9509d9d754c83eeb76e5a4924aaad26e622ba9b17e8
• C:\Program Files\7-Zip\descript.ion - 835cb13d3e5e20d30d52c23e619006dd0da34c37daca80d5e16535845deaa4ad

Embedded URLs

• http://schemas.openxmlformats.org/drawingml/2006/main
• http://creativecommons.org/publicdomain/zero/1.0/
• http://www.gnu.org/licenses/
• http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
• http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
• http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
• http://office.microsoft.com/0
• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
• https://www.gnu.org/software/automake/manual/automake.html
• http://fsmsh.com/2753
• https://autotools.io/index.html
• http://miller.emu.id.au/pmiller/books/rmch/
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/

Embedded domains

• schemas.openxmlformats.org
• creativecommons.org
• cwru.edu
• gnu.org
• www.gnu.org
• crl.microsoft.com
• www.microsoft.com
• office.microsoft.com
• fsmsh.com
• autotools.io
• miller.emu.id.au
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 20.42.65.90
• 20.42.179.204
• 20.247.184.197
• 4.230.171.124
• 85.210.193.152
• 135.233.95.144
• 135.232.92.97
• 52.168.117.170
• 74.178.240.61
• 4.150.223.100
• 135.233.45.222
• 52.110.12.3
• 52.110.12.45

File paths

• X:\windows\system32\sysreset.exe
• C:\Windows.old\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
• C:\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
• C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1120_none_c3e
• C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1_none_eedfed
• X:\SysResetTrace-Tel-Merge.etl,
• C:\$WINDOWS.~BT\Sources\Panther\SysResetTrace-Tel-Merge.etl)
• f:\dd\tools\devdiv\FinalPublicKey.snk
• f:\dd\trinity\appnet\fx\office\viewcontrols\adapters\word\objr\i386\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.pdb

More Sivis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report