MALICIOUS — d03de61062a0f18c77a5e2c6e76146806e6de8e2360d7ee269f83cc202fe3a38

MALICIOUS — d03de61062a0f18c77a5e2c6e76146806e6de8e2360d7ee269f83cc202fe3a38 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Revell family. 11 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: d03de61062a0f18c77a5e2c6e76146806e6de8e2360d7ee269f83cc202fe3a38
• SHA-1: b28dc548bc75b98724cdcddc82f489e02e0b9cc3
• MD5: d1eced200e02efe4354b8f59cdc9ce91
• imphash: 5b01e567be64bb329759f46243f37e13
• ssdeep: 12288:Kj9Lw63ct47h4QKAzYzTFjJmAwSfxL/2Dc3jDLLmt0LDQewsAjRsgx:Kj9Lw63ct04QFzY1jBaewsAjygx
• TLSH: T135506D052009E70EE9A2A9E59D4C3E1C507279D96ABB13CCC653C91ED3E6DF720344EA
• Submitted as: d03de61062a0f18c77a5e2c6e76146806e6de8e2360d7ee269f83cc202fe3a38
• File type: pe · Size: 823635 bytes
• Verdict: malicious (100/100) · Family: Revell

Detections (11 of 56 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): Win.Trojan.Revell-1
• YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
• YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Microsoft Defender: Worm:Win32/Bloored.E
• Emsisoft (Emergency Kit): Gen:Trojan.AV-Killer.YqZ@aGGD4zm
• Kaspersky (KVRT): Email-Worm.Win32.Bloored.e

MITRE ATT&CK

• T1055
• T1057

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Revell-1 (rule Win.Trojan.Revell-1) - engine signal, weight 0.90, confidence 0.95
• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• Microsoft Defender flagged Worm:Win32/Bloored.E (rule Worm:Win32/Bloored.E) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Trojan.AV-Killer.YqZ@aGGD4zm (rule Gen:Trojan.AV-Killer.YqZ@aGGD4zm) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Email-Worm.Win32.Bloored.e (rule Email-Worm.Win32.Bloored.e) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.55, confidence 0.70
• YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
• MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.30, confidence 0.70
• Embedded network infrastructure: 2.7.6.1 - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
• inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
• http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
• http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0

Embedded domains

• www.norton.com
• norton.com
• yahoo.com
• www.yahoo.com
• microsoft.com
• www.microsoft.com
• windowsupdate.com
• www.windowsupdate.com
• www.mcafee.com
• mcafee.com
• www.nai.com
• nai.com
• www.ca.com
• ca.com
• liveupdate.symantec.com
• www.sophos.com
• www.google.com
• rohitab.com
• www.rohitab.com
• securityresponse.symantec.com
• www.google.ca
• www.crackedmindstechnologies.com
• sf.net
• crl.microsoft.com
• debian.org

Embedded IP addresses

• 2.7.6.1

Registry keys

• HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME\audio/x-aiff]
• HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME\audio/aiff]
• HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\.aiff]
• HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\.aifc]
• HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\.aif]
• HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME\video/quicktime]
• HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\.qt]
• HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\.mov]

File paths

• C:\btvsts\3481\private\softgrid\shared\include\command_line_cleaner.hpp
• T:\:d:l:t:
• X:\:`:d:h:l:p:t:x:
• T:\:h:

More Revell samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report