MALICIOUS — a0c37f80fb0d1cbf17b3a14d59c82604b4c7ed5e986cb46d540dcc6dad73b188

MALICIOUS — a0c37f80fb0d1cbf17b3a14d59c82604b4c7ed5e986cb46d540dcc6dad73b188 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Urelas family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: a0c37f80fb0d1cbf17b3a14d59c82604b4c7ed5e986cb46d540dcc6dad73b188
SHA-1: bafd17ec9f0c6c0728521576aed4f902e947972f
MD5: 9daf358b318ead4483ac1278b6cdf9b4
imphash: e77246b3d14bf4cc4fcd12f0ba31740f
ssdeep: 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBX:yIfBoDWoyFboU6hAJQnrX
TLSH: T1D649BE1CC2F26786EAF797202E508F1E70E25CDED0BE4C994793D15D22E259BD2C112A
Submitted as: a0c37f80fb0d1cbf17b3a14d59c82604b4c7ed5e986cb46d540dcc6dad73b188
File type: pe · Size: 403907 bytes
Verdict: malicious (100/100) · Family: Urelas

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Urelas-9635181-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Urelas!pz
Trellix Stinger (McAfee): Corrupt-FY!9DAF358B318E
Kaspersky (KVRT): Backdoor.Win32.Plite.bhty

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Trojan.Urelas-9635181-0 (rule Win.Trojan.Urelas-9635181-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Urelas!pz (rule Trojan:Win32/Urelas!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Corrupt-FY!9DAF358B318E (rule Corrupt-FY!9DAF358B318E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Plite.bhty (rule Backdoor.Win32.Plite.bhty) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Embedded network infrastructure: 1.234.83.146, 133.242.129.155, 218.54.31.226 - static signal, weight 0.35, confidence 0.60
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

19919 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - ac0349258b567d97bfcafbfd3bbbb805571758c22b18094c6b710b464278d83f
C:\Users\analyst\AppData\Local\Temp\refeqo.exe - 5ded5a4f55ed4b49a95ce3691beb627a7452f13d81b236c7fabd56778448f9a1
C:\Users\analyst\AppData\Local\Temp\ihbey.exe - 414725dc75959d70088e83fb1b977393a6119542929f5770c83ae48f0640e51f

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165
20.184.175.12
52.123.252.230
4.230.171.124
40.84.85.40
135.232.92.97
4.144.132.223
20.165.94.63
20.42.73.24
135.232.92.137
52.110.12.50
92.223.78.30
172.178.240.161
20.42.179.204
72.145.35.105
52.148.114.188
52.110.12.21
52.110.12.25

More Urelas samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report