MALICIOUS — a279debe9d8813a01965c09bda6e3cab7e4e5f949facdf5f1e0d92a07250b60d

MALICIOUS — a279debe9d8813a01965c09bda6e3cab7e4e5f949facdf5f1e0d92a07250b60d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Urelas family. 8 of 56 detection engines flagged it.

Identification

SHA-256: a279debe9d8813a01965c09bda6e3cab7e4e5f949facdf5f1e0d92a07250b60d
SHA-1: 3194f59caf04081ce0848e7b81746be039428d3e
MD5: 686eb3e0ab8f0409e674aa43b6495f83
imphash: ac99a5a6590e07f40380584be971cd01
ssdeep: 12288:RIbnq5ORFftIiB6gBFvST9kFO14SFoktWEY+ucXz+J6nJELcUmQ+7U:RIbq0ft8gLvoko1hmkQ5cXzyvL/f
TLSH: T17B4B239A153A015BD145B09C36029B3FC3A873A593F99BCC3A632D832253D63C97E563
Submitted as: a279debe9d8813a01965c09bda6e3cab7e4e5f949facdf5f1e0d92a07250b60d
File type: pe · Size: 480382 bytes
Verdict: malicious (100/100) · Family: Urelas

Detections (8 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.MPRESS1
ClamAV (daily): Win.Trojan.Agent-1132946
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:Borland Delphi
Microsoft Defender: Trojan:Win32/Urelas.HNS!MTB
Emsisoft (Emergency Kit): Gen:Trojan.Heur.Dmrar9EqNypGy
Trellix Stinger (McAfee): Obfuscated-FQZ!hb
Kaspersky (KVRT): HEUR:Trojan.Win32.Urelas.a

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-1132946 (rule Win.Trojan.Agent-1132946) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in tsk_e38220fe3a (pid 3136) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Urelas.HNS!MTB (rule Trojan:Win32/Urelas.HNS!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Trojan.Heur.Dmrar9EqNypGy (rule Gen:Trojan.Heur.Dmrar9EqNypGy) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Obfuscated-FQZ!hb (rule Obfuscated-FQZ!hb) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Urelas.a (rule HEUR:Trojan.Win32.Urelas.a) - engine signal, weight 0.55, confidence 0.85
Contacted 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Borland Delphi (rule DIE:Borland Delphi) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.MPRESS1 (rule high-entropy-sections:.MPRESS1) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
Packing/obfuscation: high-entropy-sections:.MPRESS1, Borland Delphi - static signal, weight 0.25, confidence 0.55
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

8422 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

s.ai
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.65.90
52.123.252.243
4.230.171.124
48.211.4.16
4.144.132.223
135.232.92.137
74.178.240.51
20.42.65.84
74.178.76.128
104.18.33.89
20.184.175.23
125.56.205.24
125.56.205.32
4.150.223.105
72.154.7.110
52.148.114.188
52.110.12.22
52.110.12.1

More Urelas samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report