MALICIOUS — ac67b1054168acb5bc2bb401ccf581fee9714e6e820ad5c1e23d3e4238446426

MALICIOUS — ac67b1054168acb5bc2bb401ccf581fee9714e6e820ad5c1e23d3e4238446426 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the ShipUp family. 4 of 25 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: ac67b1054168acb5bc2bb401ccf581fee9714e6e820ad5c1e23d3e4238446426
SHA-1: 454632f83d712d492d75a71bd208c3e33a17b790
MD5: 7a866d92bedd8f57fbfb2859e488c58e
imphash: 11b47caef64b54d3c3efa7c94546ad2b
ssdeep: 3072:mQchyinW3kIncLnntG/j/BJ5mTxjnw89JnszQcJdXv:mkin4kwcDtG/j/75YxF52dXv
TLSH: T197417ABF754F6EE6E585CC22426CFB2D337DC95835C10714A83A98BF363A9A30854611
Submitted as: ac67b1054168acb5bc2bb401ccf581fee9714e6e820ad5c1e23d3e4238446426
File type: pe · Size: 185880 bytes
Verdict: malicious (93/100) · Family: ShipUp

Detections (4 of 25 engines)

Kaspersky (KVRT): Trojan.Win32.ShipUp.boq
Microsoft Defender: Trojan:Win32/ShipUp!pz
Emsisoft (Emergency Kit): Trojan.Ransom.Cerber.1
Trellix Stinger (McAfee): Packed-AM!7A866D92BEDD

MITRE ATT&CK

Why this verdict

The malicious score of 93/100 is the fusion of 4 weighted signals:

Dropped a malicious payload (Redirect): 4c2c207a1f4cf4f53e149dd744aef30dbf9434014845d28921c9b365254a26be - dynamic signal, weight 0.80, confidence 0.90
Memory forensics: 5 finding(s), e.g. process hollowing in MicrosoftEdgeU (pid 636) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.70, confidence 0.85
Contacted 58 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

2482 behavior events · 1 ATT&CK techniques · 6 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/26914/files/4c2c207a1f4cf4f53e149dd744aef30dbf9434014845d28921c9b365254a26be - 4c2c207a1f4cf4f53e149dd744aef30dbf9434014845d28921c9b365254a26be
/opt/CAPEv2/storage/analyses/26914/files/d3d14c684db75ac98d9a034ae2800bfafa156f6d74e5933b3968813bb4f080e4 - d3d14c684db75ac98d9a034ae2800bfafa156f6d74e5933b3968813bb4f080e4
29b71f3d29195b11fa2a54e88d1eccd9c04e82bf0596dac3a7fd74c1a594e192 - 29b71f3d29195b11fa2a54e88d1eccd9c04e82bf0596dac3a7fd74c1a594e192
207cbef64549c0af945ab6439f3154d28ff8dfb2ec0a499e4ba8085125fd0fbe - 207cbef64549c0af945ab6439f3154d28ff8dfb2ec0a499e4ba8085125fd0fbe
810e21811e2749596905149f4b9c91d5195d7a40703182683f489ee540163bee - 810e21811e2749596905149f4b9c91d5195d7a40703182683f489ee540163bee
9ec0026f55850a82355edceaf19f15dd7d182e5e10a17af7029dcca72ffd60a3 - 9ec0026f55850a82355edceaf19f15dd7d182e5e10a17af7029dcca72ffd60a3

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice/files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e?P1=1786973703&P2=404&P3=2&P4=LVbjsPAxxu6pfWzKiwpxvutq1G%2fs8WRQqQTEqCpdCBRPLeh3Lajkh%2f66yrLFJ5tteMQJGljyYZ%2bjnu2FcC7M7Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.42.65.93
172.215.188.225
52.123.252.247
48.211.4.16
4.230.171.124
20.76.201.171
74.178.240.61
20.42.179.204
20.42.73.31
52.110.12.20
135.234.160.245
52.110.12.4
135.232.92.137
13.69.116.105
92.223.78.30
162.159.142.9
135.233.95.135
74.178.76.128
52.253.84.76
52.123.252.240
20.42.65.94
72.145.35.103
20.184.175.20
52.148.114.188
203.26.79.13

More ShipUp samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report