MALICIOUS — cfac9a442c94a276fee001d8c862c893d8d250d6949ad7ab114931e542c043e5

MALICIOUS — cfac9a442c94a276fee001d8c862c893d8d250d6949ad7ab114931e542c043e5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sivis family. 7 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: cfac9a442c94a276fee001d8c862c893d8d250d6949ad7ab114931e542c043e5
SHA-1: 4b42013c6887441fabad70895954e1626024f4c5
MD5: 86f87cec3ed700083f40cd7c5c3b7b33
imphash: b10d16eedb1085ef7262dfc4ab03be6f
ssdeep: 768:olnK2Eq3GcOnAMS+CprKccKKKKKKKKKKcqXW5lmzxjNslpuCUtblllr84VBIxDft:KEq3GcOAMjCAWblwl44Vq3UTa
TLSH: T183384B5B2120E03FE4E19E07005CF4FDC9C228E95EB143469754A6B885BC92BA75FF89
Submitted as: cfac9a442c94a276fee001d8c862c893d8d250d6949ad7ab114931e542c043e5
File type: pe · Size: 77361 bytes
Verdict: malicious (100/100) · Family: Sivis

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Sivis-9908037-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Sivis-9908037-0 (rule Win.Malware.Sivis-9908037-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Sivis.A (rule Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Agent.es (rule Virus.Win32.Agent.es) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Dropped 9 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

19934 behavior events · 0 ATT&CK techniques · 98 dropped files.

Dropped files

C:\Program Files\7-Zip\Lang\kaa.txt - 41a9537d79599180f2c2890bcbafd2a98d43127c64b25d96eb3b8f3bd9286971
c6e189e24840923de334082529dbc5e4e494b448cf49c66c7df3d341ac01bc7c - c6e189e24840923de334082529dbc5e4e494b448cf49c66c7df3d341ac01bc7c
C:\Program Files\7-Zip\Lang\kab.txt - 3076fd499367332cc46bf5e16c97e7a71ff0d57d328a01d82d3bb2b5adc4ccca
C:\Program Files\7-Zip\Lang\cs.txt - 25bbac381ed73affdc2a9755b5051c676dbfc9d9c7932dc7d95aa2460ebf5284
C:\Program Files\7-Zip\Lang\ka.txt - f54587b277220de137540892f929037bf4d271773fec56eba2c2c94da9814c2a
C:\Program Files\7-Zip\Lang\ga.txt - bac611af0084b15d2d1c93967ecee4bdb0411ec87fa50224d6c2389830ca2888
C:\Program Files\7-Zip\Lang\id.txt - ec7bf0ec3ec48e5fd5c3dec9077ccc6fb3d4d921289cec6f16c9315657ce8ee1
C:\Config.Msi\PTA956.tmp - 44ba18c8f3027b6aa9ae7e687327bb47046ada179c0b5b2acc19236ee2c52412
C:\Program Files\7-Zip\Lang\ky.txt - 166d7c3f9cbdd96b409beaf72aa01970345dcd5b2d68ab12deeab89db3778a3f
C:\Program Files\7-Zip\Lang\fy.txt - aa6c0e2ba7b909914593917105f2e1735dc72d71fa03051ffbb1aa2965185034
C:\Program Files\7-Zip\Lang\mn.txt - 2f638bc9d06a23aae00a12205ee56622225108d8103f8c33b66a70350a158ba7
C:\Program Files\7-Zip\Lang\kk.txt - 9be3cb2743a146fb25022b4b4a45160600b49e9f1bc4c6874837d21622f1ac38
C:\Program Files\7-Zip\Lang\lij.txt - e4b15260dacf86709e53439375b6f4c46cc4c4d17f01a0742fb122a813c0855a
C:\Program Files\7-Zip\7zG.exe - 84fcbf4f290ed63ac38e2e8c15d8f444fec024cf9e4a5161d268481580657055
C:\Program Files\7-Zip\7z.dll - 7bac153fa94d36b948ea30407ee258b2aa33b911a6d581b4da6ee04d4a09155b

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.98
52.123.252.227
4.230.171.124
20.42.179.192
20.165.94.63
74.179.77.164
104.208.16.94
104.18.33.89
4.207.44.75
20.247.185.124
40.84.85.40
92.223.78.30
172.178.240.162
52.110.12.52
52.110.12.50
4.150.223.105
51.105.71.136
52.110.12.3
52.110.12.24

File paths

C:\Windows.old\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
C:\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim][gle=0x00000020]
C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1120_none_c3e
C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1_none_eedfed
X:\SysResetTrace-Tel-Merge.etl,
C:\$WINDOWS.~BT\Sources\Panther\SysResetTrace-Tel-Merge.etl)
X:\windows\system32\sysreset.exe
C:\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]

More Sivis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report