MALICIOUS — c64616dd5586b062554bfa76ba24fca1c101d278878b017b45d045540542f071

MALICIOUS — c64616dd5586b062554bfa76ba24fca1c101d278878b017b45d045540542f071 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Unruy family. 5 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: c64616dd5586b062554bfa76ba24fca1c101d278878b017b45d045540542f071
SHA-1: 62502cd6fd5c2bd2cabdc5ef5dcc1c26228e89ae
MD5: 65a0368c202d0991e6d182ad4c5341ad
imphash: 799648032be17bf6d9bce0159e2ededa
ssdeep: 6144:sm5UsluzKOwoW+Yzckp8HLzKYQ6pU27yaAgaXHm6hsOZL:smqslOKU33rQQujN3f
TLSH: T1FB46AF221A1ABE30D72F3F296818E70FBA035E3F91ED362651508B1B795811FD3D5229
Submitted as: c64616dd5586b062554bfa76ba24fca1c101d278878b017b45d045540542f071
File type: pe · Size: 291476 bytes
Verdict: malicious (99/100) · Family: Unruy

Detections (5 of 56 engines)

ClamAV (daily): Win.Downloader.Unruy-6988793-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: TrojanDownloader:Win32/Unruy!pz
Emsisoft (Emergency Kit): Gen:Variant.Barys.458891
Kaspersky (KVRT): Trojan-Clicker.Win32.Cycler.amiy

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Downloader.Unruy-6988793-0 (rule Win.Downloader.Unruy-6988793-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged TrojanDownloader:Win32/Unruy!pz (rule TrojanDownloader:Win32/Unruy!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Barys.458891 (rule Gen:Variant.Barys.458891) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Clicker.Win32.Cycler.amiy (rule Trojan-Clicker.Win32.Cycler.amiy) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 2 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

399 behavior events · 0 ATT&CK techniques · 5 dropped files.

Dropped files

C:\program files (x86)\internet explorer\wmpscfgs.exe - ef0bafee4ebecc859284b6465ff7255fcb9490b676bf73f6be206fa5b7624296
C:\Users\analyst\AppData\Local\microsoft\OneDrive\onedrive.exe - 55854879927a2ad3d794046440c86f231719a70adfb72f76e42de83d4223ca5c
C:\program files (x86)\Adobe\acrotray.exe - 626f09869e57fb3c48a6f1a8c7e3f3bb379477c55f71acde583bdc06cb3cbf77
C:\program files (x86)\Adobe\acrotray .exe - b267900406d3e662f96ff9bef298ddab7e97dff86c9a0d4997484fd175e7e145
b7fbcf5acfccd3032ee330a9d4c1acb97c2223c3c242dd2104361bb4bd076684 - b7fbcf5acfccd3032ee330a9d4c1acb97c2223c3c242dd2104361bb4bd076684

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

20.42.65.94
52.123.252.215
20.42.179.192
4.230.171.124
135.233.95.135
13.89.179.15
74.178.76.128
52.168.117.169
4.144.132.223
172.64.154.167
20.165.94.63
52.110.12.51
52.110.12.55
135.234.160.246
52.110.12.24
52.110.12.31

More Unruy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report