MALICIOUS — b5b91bfc6ed0f4e124a9222663098b0ea7269a170e81865a017dd3b941e062b7

MALICIOUS — b5b91bfc6ed0f4e124a9222663098b0ea7269a170e81865a017dd3b941e062b7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Upatre family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: b5b91bfc6ed0f4e124a9222663098b0ea7269a170e81865a017dd3b941e062b7
SHA-1: 50a1ee2c47f2ca5a52cf2ef07a38caacea7297fc
MD5: 5876d17ff7c222a34b3fb7ebd860ac01
imphash: fb205081ca935568918c6c78c3c5e54a
ssdeep: 3072:Of98YjR2F8HxMOEJbcSt6db0kevP+GkG:0ABR/
TLSH: T18E3DF6CD416C1B66C77B44A15B36C94ED186F0E608AC39090987C03EB9C39B7AC75A77
Submitted as: b5b91bfc6ed0f4e124a9222663098b0ea7269a170e81865a017dd3b941e062b7
File type: pe · Size: 135571 bytes
Verdict: malicious (100/100) · Family: Upatre

Detections (5 of 56 engines)

ClamAV (daily): Win.Packed.Upatre-9771589-0
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: TrojanDownloader:Win32/Upatre
Emsisoft (Emergency Kit): Gen:Trojan.Ipatre.1
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Packed.Upatre-9771589-0 (rule Win.Packed.Upatre-9771589-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged TrojanDownloader:Win32/Upatre (rule TrojanDownloader:Win32/Upatre) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Trojan.Ipatre.1 (rule Gen:Trojan.Ipatre.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

1739 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\H9BOFF51\UU5RKLRB.txt - f21ecdabafce078b3d71b5b80bd08c1a8f5f8cda4d2c4068aef27c4482b86360
C:\Users\analyst\AppData\Local\Temp\yaxkodila.exe - 039fb927413403da21e8607689ddc5ffb5180804e24c895f9288d5bb0bebb246
91aec32b62b42487e33d7a3ad0fe10a3cea907858db4f3c5bddacf8c7777466b - 91aec32b62b42487e33d7a3ad0fe10a3cea907858db4f3c5bddacf8c7777466b

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://icanhazip.com/

Embedded domains

icanhazip.com

Embedded IP addresses

51.132.193.105
52.123.252.245
4.230.171.124
57.155.104.224
135.232.92.97
20.42.65.91
135.233.95.144
20.247.184.142
20.184.175.6
52.123.252.235
104.18.33.89
162.159.142.9
135.234.160.245
104.16.184.241
52.110.12.54
52.110.12.48

File paths

f:\dd\vctools\crt\core_crt\src\appcrt\internal\winapi_nonmsdk.cpp
f:\dd\vctools\crt\core_crt\src\appcrt\internal\winapi_downlevel.cpp
C:\c0effd1b47d9526e79f40fd9814b607047662bdbe6e19f4c882ee0f7834e9b71
C:\bf32d3b0\b662ef49.exe
C:\40e958413310ed95f815cf0ca906b10f64d21e675d4180d4e59878cb2db6f919
C:\b3dceca9ea1f7449cbd2d0a5a80bee251ca0270b47749d72699e651d7af4483b
C:\18c4f3687892a2a29bb833de5ea760d2a2d04c231d245f160988250357d020db
C:\e3d3ccfd07df5949269c11d0dbff6f579feb8db7fe34ab69a997c5d123619fb8
C:\3Wy6f11a.exe
C:\DQZv55PH.exe
C:\acaa2f9b3f82d67531d3d602e56c13ab9ce4e36f6742213a8b0692d0cfac8a62
C:\6a186ec90740c3a935a5737109de04ec046aaf2ece0f7453c16a2be5618a98cf
C:\GofurbWB.exe
C:\xZOQ46n9.exe
C:\uqxd6QkJ.exe
C:\WjgHnnYB.exe
C:\2rLT0KlW.exe
C:\3f25edcc42328c2d3b3274db792be7edb2dda7fed2b41e6ac2c52276b3d9e45b
C:\jabLWKC4.exe
C:\6gdpgXjP.exe
C:\kn0eLbLN.exe
C:\fcYT1n0s.exe
C:\NnozXTnr.exe
C:\ykekULKC.exe
C:\4e61bcb2c273c27f14dae2f47b39dff1274fa3e34aca84e693f2f6094bd0606c

More Upatre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report