MALICIOUS — d732b243fbff1989161022ef0308fbb502ba5a902ecdcabd4da6c93226994b8f

MALICIOUS — d732b243fbff1989161022ef0308fbb502ba5a902ecdcabd4da6c93226994b8f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Upatre family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: d732b243fbff1989161022ef0308fbb502ba5a902ecdcabd4da6c93226994b8f
SHA-1: cbbd68d817fae20fec43134b372c749e521c128d
MD5: e5c3deb802901775e800e0809e7f3748
imphash: e8a152262666487600bae63a404244a1
ssdeep: 768:MiPPTYiNCSAetFpamkQzXmRItONlg8PyNUMsFYsktATb6jzUi2RTlR7Q:M0FptJiNng8dViN0m/2RpR7Q
TLSH: T1E237C0CD41BC1B6BC33A04E51636E95EA1DBF0E10AED311A095DA03D90C38E3AD52E76
Submitted as: d732b243fbff1989161022ef0308fbb502ba5a902ecdcabd4da6c93226994b8f
File type: pe · Size: 75094 bytes
Verdict: malicious (100/100) · Family: Upatre

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Downloader.Upatre-10023862-0
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
Microsoft Defender: flagged
Kaspersky (KVRT): HEUR:Trojan-Downloader.Win32.Upatre.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Downloader.Upatre-10023862-0 (rule Win.Downloader.Upatre-10023862-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.Win32.Upatre.gen (rule HEUR:Trojan-Downloader.Win32.Upatre.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70
Contacted 4 external host(s) and 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

11855 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\hromi.exe - 4061afaae49f9bc4541b4eaea1e34fd90463f583319d435413e62c84f658971c

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://yr.c.lencr.org/
http://yr2.c.lencr.org/110.crl
http://yr1.c.lencr.org/84.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl

Embedded domains

freedataverification.com
sellmakers.com
x1.c.lencr.org
yr.c.lencr.org
yr2.c.lencr.org
yr1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org

Embedded IP addresses

20.184.175.15
4.230.171.124
52.230.59.222
172.64.154.167
52.110.12.10
135.234.160.245
40.84.97.4
104.18.20.213
104.18.21.213
92.223.78.30
72.153.5.141
34.209.195.255
2.57.91.91
52.110.12.33
52.148.114.188
52.110.12.42

File paths

y:\wildlist\131227\33992ee7788627b401f8fdcea2c61a39.exe
C:\rsdov.exe
c:\c68eb46a0bd2bf83b1d505cbd8754aec.exe
C:\ybyngr.exe
C:\ibsfov.exe
C:\yxmhitsv.exe
C:\rwdan.exe
C:\34k072fY.exe
C:\xNiU1rFI.exe
C:\8uZyNj6H.exe
C:\uvSC7Del.exe
C:\LlSoZwXN.exe
C:\d33faHLj.exe
C:\73mYKaWf.exe
C:\NGARwule.exe
C:\twwtb5Yt.exe
C:\Wi7IDyMT.exe
C:\PtapgVH7.exe
C:\UnktcQEM.exe
C:\a7kfsZAn.exe
C:\Cs_Jfaeq.exe
C:\QyYmxwJs.exe
C:\3ddYvwu6.exe
C:\0gTR6SqF.exe
C:\Nd94wSWs.exe

More Upatre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report