MALICIOUS — aa9d6c9ac0d7f13bbbc306763ab9ee9087908a3a494826decb966b612e221ee5

MALICIOUS — aa9d6c9ac0d7f13bbbc306763ab9ee9087908a3a494826decb966b612e221ee5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Sivis family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: aa9d6c9ac0d7f13bbbc306763ab9ee9087908a3a494826decb966b612e221ee5
SHA-1: 1c67c55a0889a2c7604f6b1403ab09ba293f0b64
MD5: 945f9b7fab7314c0bf7e2fbdab30ef18
imphash: 38aa7c2ff6ef0e48a9520d6702d08df4
ssdeep: 12288:hxKEFMFnghuuw0g2m99kIi7QVbo7JVVTOix1c60yOFhNGpWU:hxKEFMFnYTXipgMbo7JXTyFhNGpWU
TLSH: T179499EE60165711FCDE7AE57280CCC9DC843B08525751B6E024BD60C44B8EBFAEF62A6
Submitted as: aa9d6c9ac0d7f13bbbc306763ab9ee9087908a3a494826decb966b612e221ee5
File type: pe · Size: 395018 bytes
Verdict: malicious (99/100) · Family: Sivis

Detections (4 of 56 engines)

ClamAV (daily): Win.Trojan.Agent-6943819-1
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-6943819-1 (rule Win.Trojan.Agent-6943819-1) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Sivis.A (rule Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Agent.es (rule Virus.Win32.Agent.es) - engine signal, weight 0.55, confidence 0.85
Contacted 1 external host(s) and 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, http://www.gnu.org/licenses/, http://cygwin.com/cgi-bin2/package-grep.cgi?text=1&grep= - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Extracted generic config (4 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

17635 behavior events · 0 ATT&CK techniques · 97 dropped files.

Dropped files

C:\Program Files\7-Zip\Lang\an.txt - cf4e4f5b2621bfcc2c0cebe2c6988c1b1dfd30a71c83b9202d2a8dc3f9050728
C:\Program Files\7-Zip\Lang\kk.txt - 0e9d1763441cb3bb9524b617f9106eb594c40d5d587a622725bbc9d514244d92
C:\Program Files\7-Zip\Lang\ca.txt - 2001661fc677c646bc4743b8f753274dcfc0187045e5a6c6ec6b0b0eb9687a38
C:\Program Files\7-Zip\Lang\bn.txt - 9a9a1ba93c632dc56325505fbc1812d825a6d7c41b728909ee9378fe3acbeca4
C:\Program Files\7-Zip\Lang\lv.txt - bd81cc639863a0276dcb2c755ee3454d5d4637d9fb82f5b9d9ab37ec98b769e3
C:\office-config.ps1 - e4dde6d90d6bbc09a33d33b21946905bab2eea69b6fd7af3dfeaf10f410cd1cf
C:\$WinREAgent\Backup\boot.sdi - 691283dd348cfe68702e6532468e338980f1585761424652b81003631171220f
C:\Program Files\7-Zip\Lang\ga.txt - 07a21cc40a059de60e2f2e66c44910bf1dedaeeaa492a79888a84f8f091fc75d
C:\Program Files\7-Zip\7zG.exe - 9f3753e76691b17dde61afe1193cb508cf8465573c9a51a96ff052fc2b86c20c
C:\Program Files\7-Zip\7-zip.dll - 5b230518428f0714e077072c5748862914aeb509dd47a36d26bf1d50c7fd5bd7
C:\Program Files\7-Zip\Lang\hr.txt - 407c39f4ef0f930909a857054d85066514a988f70967a17ea550e8336dff9320
C:\Program Files\7-Zip\Lang\et.txt - 84e26e1a33d2fce7feb45eb14e1a198814ece0571d4b638c28e70f84a1b85f67
C:\Program Files\7-Zip\Lang\da.txt - 730c130bd5beced28628223de37c4798711279b620af4ad4931d2b7121fd324b
C:\Program Files\7-Zip\Lang\id.txt - 7a11e6ad5274609c47f52fda9957f12c2b586a791de90d090744e52f83c3bc6b
C:\Program Files\7-Zip\Lang\ka.txt - c41f5a72b14bca83126ffacbaba612f62f63c8bc61929da547e701f89ce2b1d6

Embedded URLs

http://creativecommons.org/publicdomain/zero/1.0/
http://www.gnu.org/licenses/
http://cygwin.com/cgi-bin2/package-grep.cgi?text=1&grep=
https://www.gnu.org/software/automake/manual/automake.html
http://fsmsh.com/2753
https://autotools.io/index.html
http://miller.emu.id.au/pmiller/books/rmch/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

creativecommons.org
geocities.com
cwru.edu
gnu.org
www.gnu.org
cygwin.com
bloda.cc
fsmsh.com
autotools.io
miller.emu.id.au

Embedded IP addresses

20.42.73.27
20.247.185.124
4.230.171.124
135.232.92.97
57.154.63.210
135.232.92.137
51.132.193.104
135.234.160.245
52.110.12.1
52.110.12.56
52.110.12.46
57.155.101.212

File paths

X:\windows\system32\sysreset.exe
C:\Windows.old\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
C:\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1120_none_c3e
C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1_none_eedfed
X:\SysResetTrace-Tel-Merge.etl,
C:\$WINDOWS.~BT\Sources\Panther\SysResetTrace-Tel-Merge.etl)
C:\Windows.old
C:\.
C:\Windows.old\Windows\System32\Config\Software.
C:\\Windows\System32\Config\Software.

More Sivis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report