MALICIOUS — c650d7ac82fc30afc81f94e7dd29c4598ea96c977acb8a96c6835211c9b6d188

MALICIOUS — c650d7ac82fc30afc81f94e7dd29c4598ea96c977acb8a96c6835211c9b6d188 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Multiverze family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: c650d7ac82fc30afc81f94e7dd29c4598ea96c977acb8a96c6835211c9b6d188
SHA-1: 4b56e6895cc6c42b82383a36ee9f0730332ecd45
MD5: 732df7eadfcb5e438af3c828bc8df468
imphash: 0d52988c17b6d0ad679318ef76f1e151
ssdeep: 1536:BL+O/U7OBmKGS6CBK0t/ZCXPGuxgDM5YKBGNc/xf6KWcs8+SUkIcekqY1o/uImz1:BLxUyjp3xCTyDMsUWyw+Ubx7NS
TLSH: T1653D5BD29D037521E07ADA886C1476FC84A2F8AD3935814D635BC90E10F797BB93236E
Submitted as: c650d7ac82fc30afc81f94e7dd29c4598ea96c977acb8a96c6835211c9b6d188
File type: pe · Size: 134154 bytes
Verdict: malicious (100/100) · Family: Multiverze

Detections (5 of 56 engines)

ClamAV (daily): Win.Malware.Ulise-9886066-0
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
Microsoft Defender: Trojan:Win32/Multiverze!pz
Emsisoft (Emergency Kit): Generic.Dacic.1660.B70A67F1
Kaspersky (KVRT): HEUR:Trojan.Win64.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Ulise-9886066-0 (rule Win.Malware.Ulise-9886066-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in tsk_6198367342 (pid 8720) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Multiverze!pz (rule Trojan:Win32/Multiverze!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Generic.Dacic.1660.B70A67F1 (rule Generic.Dacic.1660.B70A67F1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win64.Agent.gen (rule HEUR:Trojan.Win64.Agent.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70
Contacted 9 external host(s) and 52 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://pm2pavba27wr4m34.onion/command.txt?smbdff - static signal, weight 0.35, confidence 0.60
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

1885 behavior events · 1 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\cached-consensus - 69ae7f3c63b191f7701db42e8fe0b24c5b57ff1aa43e8d3ae4b58f8597cdf19c

Embedded URLs

http://pm2pavba27wr4m34.onion/command.txt?smbdff
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://171.25.193.9:443/tor/status-vote/current/consensus
http://216.218.219.41/tor/server/fp/c460e8a702592ef52116466bba2725e11fb82ac9
http://216.218.219.41/tor/server/fp/40fe40a2b624c86086cf04d1089cc264e16f72a3
http://204.13.164.118/tor/server/fp/ac9d89e7a99b7f95e115be6d5d219d4196b09790
http://204.13.164.118/tor/server/fp/acb898b28acabbd78f23af2fb06fc864a4111646
http://216.218.219.41/tor/server/fp/acbbb426ce1d0641a590bf1fc1cf05416fc0ff6f
http://204.13.164.118/tor/server/fp/8ec879f5955ad3db5c13bca686ee5967469b909c
http://216.218.219.41/tor/server/fp/8eccba855814f6369d3efdbd02fc6bf5ab258b03
http://204.13.164.118/tor/server/fp/8ee44717fa55705c12086f3ecd1f8d9c8676fd05
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://216.218.219.41/tor/server/fp/0ff228e319ac2350bcca4e0345e73430b8e4cc79
http://204.13.164.118/tor/server/fp/ea7d575c91bb1f53c25510fbf91b87d81ae14646
http://128.31.0.39:9131/tor/status-vote/current/consensus
http://204.13.164.118/tor/server/fp/7ff8f83dd10d3e685b6846d5c32593c1b62a9945
http://216.218.219.41/tor/server/fp/d0caa33153aacc69d54d6a318592e1f05df5213a
http://216.218.219.41/tor/server/fp/ac9d89e7a99b7f95e115be6d5d219d4196b09790
http://204.13.164.118/tor/server/fp/acbbb426ce1d0641a590bf1fc1cf05416fc0ff6f

Embedded domains

pm2pavba27wr4m34.onion
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.102
40.84.97.4
4.230.171.124
52.230.60.54
20.165.94.54
20.165.94.63
51.116.253.170
104.18.33.89
194.109.206.212
74.178.240.61
171.25.193.9
216.218.219.41
204.13.164.118
135.125.103.47
128.31.0.39
212.227.161.35
20.42.73.25
176.65.148.3
72.154.7.98
52.148.114.188
64.65.62.84
52.110.12.8
52.110.12.16

More Multiverze samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report