MALICIOUS — bdbcbde4080ace797d4c004d78662af16d0f0a487b057d10dcf9fc76a852ff83

MALICIOUS — bdbcbde4080ace797d4c004d78662af16d0f0a487b057d10dcf9fc76a852ff83 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upatre family. 3 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: bdbcbde4080ace797d4c004d78662af16d0f0a487b057d10dcf9fc76a852ff83
SHA-1: ac9ff529e3e41e574da21a6ef7ae825924eb2e9f
MD5: 770842c1a10ce753b9b9c73427581aec
imphash: b1decad0f067131fff2e76ab43787f60
ssdeep: 96:QwmYtPvLGau/wAnQWRRUh2CqDxSOsntp5HU93+UplKG/+RVL0xOjddtu7:ZmYt2dQWRRQwOF09dlN/+RJC8+
TLSH: T1E022ACCD40AC1B6BC77618F61632D94EA1A3B0E619ED755E1D4C912D80C28E3DD26E33
Submitted as: bdbcbde4080ace797d4c004d78662af16d0f0a487b057d10dcf9fc76a852ff83
File type: pe · Size: 9772 bytes
Verdict: malicious (99/100) · Family: Upatre

Detections (3 of 56 engines)

ClamAV (daily): Win.Malware.Upatre-7393915-0
Microsoft Defender: Trojan:Win32/Zbot.FFH!MTB
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Upatre-7393915-0 (rule Win.Malware.Upatre-7393915-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Zbot.FFH!MTB (rule Trojan:Win32/Zbot.FFH!MTB) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

12092 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\gffos.exe - ddb0cb643a0cca97f9575e8bd4ba49d795229b90f31480273dc13141557a1a88

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

evedbonline.com
alamx.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.103
20.42.179.192
4.230.171.124
74.178.240.51
20.247.185.124
20.42.65.90
74.178.240.61
74.178.76.128
172.178.240.163
4.209.250.170
52.110.12.4
20.184.175.22
52.110.12.25
34.104.35.123
203.26.79.13
125.56.205.24
125.56.205.123
52.148.114.188
92.223.78.30
52.110.12.10
52.110.12.49
72.154.7.104

File paths

C:\d2b3f321ec7fbba1f310967df41f99b360a7d230a498a3e4781d558816f13294
C:\1a94d7cb766cd8ff89bbde3132d9aeea77a759c8f9594a5a05a5a5552315fc78
C:\5912113ec3d977607b86652b50addfdfaf4970d5d3e183819b5b60edf449692f
C:\066bd690954eec76d44ce5dbe8c751789c9f1238c2cbfbd51118294137f32591
C:\Users\Lisa\Desktop\rVcfQpiY.exe
C:\Users\george\Desktop\program.exe
C:\Users\Lisa\Desktop\YUwRpxeR.exe
C:\Users\admin\Downloads\3ca90911be3cde5e2f2f76392d43b9929a3fe1faf968ef9fc254eafd2419ed79.exe
C:\Users\george\Desktop\gffos.exe
C:\Users\admin\Downloads\gffos.exe
C:\5f5c253367bbb89581eb172d854163741a11f26e2ac93226ee4b0a8285a6854e
C:\Users\Lisa\Desktop\qKMXgrXU.exe
C:\Users\admin\Downloads\056fc2469ad2cc8f7cc482bbbc3e6453ff3e31cec0242adb4a27b5aed736bd39.exe
C:\9436801a81b49c679bdae8a4d5e3ce48ec6043888e65e8b1b6739d96d3e8a4cd
C:\Users\Lisa\Desktop\RWWYGVEJ.exe
C:\Users\admin\Downloads\2f10eed863d929ac677d6fa8b55e6351deb294922b3efc7b9e430056dd581b01.exe
C:\ebe8333cbb9711da6d1e443654b7e1cec7680a6e1854277c908eea5224ef3169
C:\7ad803fb496f39c9557c354fd83e5c5c662f0911e6f98b1a9a3e9be4d3b60811
C:\Users\admin\Downloads\3164e5588550faabfca0fe1e2156be30b6833ac5cc0ee685254851b151a22186.exe
C:\1bb72ab2569c370a2ad79fa9b78b2f75adfb6ff0343f859b40d7485d4d58f939
C:\Users\admin\Downloads\79cee259de559da5278ce2126369e143d2171da4cd7eb0fbe523655b3aafeb16.exe
C:\Users\admin\Downloads\9bae6bff935f0640b5c9390956081a3e37038efbe09c5a0fb06fb904a750a22c.exe
C:\Users\admin\Downloads\dfa15554b9e08d513178822a99e4401206176fcba6217923f2f83fd2ef76a880.exe
C:\Users\Lisa\Desktop\UJbdXlGF.exe
C:\9b2558f6a24e7cc7c46a2dfda44b2142345f970c2ea6bae087cb71b12740bfb4

More Upatre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report