MALICIOUS — bc74af72ef6ee747b6cebaa8a0e89107c733f3a86fceca51c1ac89784b7a1aa9

MALICIOUS — bc74af72ef6ee747b6cebaa8a0e89107c733f3a86fceca51c1ac89784b7a1aa9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Bulz family. 7 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: bc74af72ef6ee747b6cebaa8a0e89107c733f3a86fceca51c1ac89784b7a1aa9
SHA-1: 8bf8ddabc598dd476537841c936f407d260ce429
MD5: c1215f2f9f989b71609ae0fd70497687
imphash: c36eed49d8b97cc9ea6318c04a69dbb6
ssdeep: 6144:81db49+rEg024fpLZazEjvE/rbay19tSt4bO2BaDmeBJe/ZVMXTw:8jkArEN249AyE/rbaMct4bO2/n
TLSH: T1A9462303B6BC155FC39EAC726613221FF0E6A5FFA6396710A2D081261B82453891F793
Submitted as: bc74af72ef6ee747b6cebaa8a0e89107c733f3a86fceca51c1ac89784b7a1aa9
File type: pe · Size: 292107 bytes
Verdict: malicious (100/100) · Family: Bulz

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Bulz-9940102-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/AutoitGenome!pz
Emsisoft (Emergency Kit): Gen:Variant.Bulz.821954
Kaspersky (KVRT): Trojan-Downloader.Win32.Agent.gpyl

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Bulz-9940102-0 (rule Win.Malware.Bulz-9940102-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/AutoitGenome!pz (rule Trojan:Win32/AutoitGenome!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Bulz.821954 (rule Gen:Variant.Bulz.821954) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Downloader.Win32.Agent.gpyl (rule Trojan-Downloader.Win32.Agent.gpyl) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

29038 behavior events · 2 ATT&CK techniques · 10 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61 - 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 - 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3 - 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\17A440B37A6A20289A68E145191710C9 - 0322b1995812661a739b4661c19939afac5b8ada15b360f6134e798346aa4cd6
C:\Program Files\Managemenot\Monitor\tcpscrex.exe - 1946eca7ad8af8ac32a948ca63e38fc5f474dac76a8a0258b1106f43120ac69f
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3 - 0b810f5ac40097ba3f9f2e3348542489f6fb22b44acfb1bf6738a32614d511f3
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61 - 5c87ed941d5ecf84ce449aa60bb6655919eaad633324fc286981153d570cfc9d
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\XRUA1FHR\getip[1].htm - 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 - 05c86733680d1ec8f290bed1066dcfeafdce151dad3597f3af5b1596478f915a
65537254937755af4f726378998a80b84dc30f3b698ebfb57ab7a3b62773c7a9 - 65537254937755af4f726378998a80b84dc30f3b698ebfb57ab7a3b62773c7a9

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://w347302.s98.ufhosted.com/getip.asp
http://www.aamailsoft.com/getip.php
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://ye2.c.lencr.org/22.crl
http://W347302.S98.Ufhosted.Com/NC/UP/Down.txt

Embedded domains

w347302.s98.ufhosted.com
www.aamailsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
ye2.c.lencr.org

Embedded IP addresses

20.42.65.88
52.123.252.213
4.230.171.124
172.215.188.232
20.247.185.124
20.42.179.192
104.18.33.89
135.233.95.135
74.178.240.61
52.168.117.170
101.227.111.7
66.175.209.193
104.18.21.213
48.211.4.16
92.223.78.30
135.234.160.245
20.42.65.84
4.207.44.71
72.145.35.96
52.148.114.188
52.110.12.22
52.110.12.3

More Bulz samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report