MALICIOUS — b3ecd6b57433402c1ff9760093e3e422405a1357754f55d0f0ccf5c57365d7de

MALICIOUS — b3ecd6b57433402c1ff9760093e3e422405a1357754f55d0f0ccf5c57365d7de is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the FuBu family. 5 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: b3ecd6b57433402c1ff9760093e3e422405a1357754f55d0f0ccf5c57365d7de
SHA-1: f704aabb0b0aa913a2403d29cfe28542ec850278
MD5: bbdfeaca00a8df02e3618df0b8e963b8
imphash: 77f13bc24efea5a05601b43cf44d1f1a
ssdeep: 3072:NR2FoC54JS8y9cPz4B8mdISwMpdCq/IM8uIGfN/ODsCQ:NSaIT2b3oISwMd7wvcz
TLSH: T1AB416A14017362DBC4F68FE0D800CE1C54526936E5BE289DA283D11FD3E15E7E3AA5B6
Submitted as: b3ecd6b57433402c1ff9760093e3e422405a1357754f55d0f0ccf5c57365d7de
File type: pe · Size: 185537 bytes
Verdict: malicious (97/100) · Family: FuBu

Detections (5 of 55 engines)

ClamAV (daily): Win.Trojan.FuBu-1
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Shodi
Emsisoft (Emergency Kit): Win32.HLLP.Shodi.A
Kaspersky (KVRT): Virus.Win32.HLLP.Shodi.a

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 97/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Trojan.FuBu-1 (rule Win.Trojan.FuBu-1) - engine signal, weight 0.90, confidence 0.95
Dropped a suspicious payload: sdraw.usa - dynamic signal, weight 0.40, confidence 0.90
Contacted 29 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis (windows)

4981 behavior events · 0 ATT&CK techniques · 20 dropped files.

Dropped files

C:\Program Files\LibreOffice\program\simpress.usa - 920fb0937f8a9d345830865059b6ae3f35ab6803ad4cffef4447473ec18e17a0
C:\Program Files\LibreOffice\program\sdraw.usa - f19afa9bbf2ef0308f37ce6cb87cb3c59eb2d1685e08d8b15fd197dda813f379
C:\Program Files\LibreOffice\program\quickstart.exe - e3080149895ee6a69dcb0c19b95de8e7b06ccc8226f1857274f401c7184b34f0
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccessinspector.usa - a7487ee88d94f322148489c818cc861ee1e77ec31ce5b5e7b5e999c0d5acf6f6
C:\Program Files\LibreOffice\program\scalc.exe - 836915083196df2a86f38044c1cd1b754249410ca02a72536cd4f60549b3f6ca
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaw.usa - 00293b1fc4c093b570c7a9433fb5b16b188e938061cacf6f7a35721a6f346acb
C:\Program Files\LibreOffice\program\sbase.exe - dce6c09e4c6511d26da1f080252cbbff0e0dda4379cd5b71698a8cc07f623f90
C:\Program Files\LibreOffice\program\odbcconfig.exe - 2dd85a26207b2bd19ff3c8070aee1155ec9e509f1b4c85dd6f0a7efd1981e078
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccesswalker.exe - 21ab30816ee42d08f1f0fbed5ea0faca20570c8b4fc58778076ccc6fc5174b0b
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccessinspector.exe - d5bcaacff7be587bd68d4fbed264248fc86733850095e4c5395673434f6fecfa
C:\Program Files\LibreOffice\program\scalc.usa - 130a4605825eea29caadb8594dd5a1762c18d778759eebcc648b4b96596ce20f
C:\Windows\System32\UsaShohdi.asu - 7fba31b16d3bbe6d9621c3aaaac014a2924ed356996408101967ac7d40d073a0
C:\Program Files\LibreOffice\program\odbcconfig.usa - 70f519a82ef226da3791ff910a9204b130b3dacc0d2da4b60412f0dae113d7b7
C:\Program Files\LibreOffice\program\simpress.exe - a26dddcf4e4b2b9d6d8fcf79f0130dc18caf9f59a81eb11a79c8c3abeeec3d47
C:\Program Files\LibreOffice\program\sdraw.exe - d809aec516ceea5d94cb57adf7e0b956a02bbea2f34f7c55c74b7dd63ed193e8

Embedded URLs

http://schemas.microsoft.com/SMI/2016/WindowsSettings
https://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-cs-g1.crl05
http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
http://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787773426&P2=404&P3=2&P4=ARzoVJEiKibIiMOIgnCAqOAn3E9k%2b1D4oGqLMZzNMPfIkKmM1KpKO86dlbwO%2bWrnlOEBVgJWRRoxn724D5XY3Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787773463&P2=404&P3=2&P4=G51tvv12cDluXbcgG9ok0uRD%2fNPNu6FSCfnU9ajLNP%2bECKl6SaIbpQjc9RmsI%2fSA58iz4UBTr7gOdTiQ9ci%2f9Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
cacerts.digicert.com
crl4.digicert.com
crl3.digicert.com
www.digicert.com

Embedded IP addresses

92.223.78.30
57.155.104.224
20.184.175.22
4.230.171.124
4.247.188.233
20.247.185.124
20.165.94.63
20.184.175.17
135.233.95.135
52.123.128.14
20.231.239.246
104.46.162.230
135.233.95.144
203.26.79.13
162.159.142.9
135.233.45.221
74.178.232.29
52.148.114.188
20.42.179.204
51.105.71.136
52.110.12.15
52.110.12.48
72.145.35.108
142.250.183.35
172.178.240.162

File paths

C:\A\34\b\bin\amd64\pythonw.pdb

More FuBu samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report