MALICIOUS — d889e8b7caf30f77f95ac8f1a386cd627b5176f0bc6133a9c0d58e7b7779ca16
MALICIOUS — d889e8b7caf30f77f95ac8f1a386cd627b5176f0bc6133a9c0d58e7b7779ca16 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Sivis family. 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
d889e8b7caf30f77f95ac8f1a386cd627b5176f0bc6133a9c0d58e7b7779ca16 - SHA-1:
49684610b3287e7d1191406d043f77c5f18882ee - MD5:
d69711942d227099db1857c22a123f9f - imphash:
38aa7c2ff6ef0e48a9520d6702d08df4 - ssdeep:
3072:3nEOvikiHXwNhokSTWEFMFnREFMFn4M+b:5vikigNhHyWEFMFnREFMFnv+b - TLSH:
T1E13B7CA52351207FC1F28C5B04ACCE7D808374E5687147E693C1EA68C0A8D77B97FA96 - Submitted as: d889e8b7caf30f77f95ac8f1a386cd627b5176f0bc6133a9c0d58e7b7779ca16
- File type: pe · Size: 112162 bytes
- Verdict: malicious (99/100) · Family: Sivis
Detections (4 of 56 engines)
- ClamAV (daily): Win.Trojan.Agent-6943819-1
- Microsoft Defender: Virus:Win32/Sivis.A
- Emsisoft (Emergency Kit): Win32.Sivis.A
- Kaspersky (KVRT): Virus.Win32.Agent.es
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 10 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Agent-6943819-1 (rule
Win.Trojan.Agent-6943819-1) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Virus:Win32/Sivis.A (rule
Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule
Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Virus.Win32.Agent.es (rule
Virus.Win32.Agent.es) - engine signal, weight 0.55, confidence 0.85 - Contacted 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
- Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, http://www.gnu.org/software/coreutils/, http://translationproject.org/team/ - static signal, weight 0.35, confidence 0.60
- Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 4 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule
windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
17714 behavior events · 0 ATT&CK techniques · 97 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- settings-win.data.microsoft.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- watson.events.data.microsoft.com
- edge.microsoft.com
Dropped files
- C:\Program Files\7-Zip\Lang\be.txt -
d2e8c9765247c12b287a9131109b1c3be00a1c19c987bcbc8ad4c83a92f7bb99 - C:\Program Files\7-Zip\Lang\io.txt -
5121851f43a9d0cac1169e29a8ae06ffb44860c0ac566b0a026d004b4cce181c - C:\Program Files\7-Zip\Lang\ga.txt -
c94de841a8effb450dfe800a288d24d9e5171e66bde2ba2b3398924f71717565 - C:\Program Files\7-Zip\Lang\pl.txt -
5a2cf70210d6b6014a97e692840ba2a149c3e88fbe5f9121688856145e33a869 - 1ff6a062704486df8cd6a1a185fdeccc0c93bee9746cc34ede71df0d98fabe5c -
1ff6a062704486df8cd6a1a185fdeccc0c93bee9746cc34ede71df0d98fabe5c - C:\Program Files\7-Zip\Lang\kaa.txt -
12b3ce2197a3f679ba4b9dae5f10824eac0fa25b5277c8e1402566dc46c39433 - C:\Program Files\7-Zip\Lang\hy.txt -
7f4ca3641b2faa7c6f34c8a2c05816fb923475d5285cbc5f8aea15cd53dc2699 - C:\Program Files\7-Zip\Lang\gl.txt -
c8efd25a1d1d9b18c637927e24a19926089be4509342c25499c933dbb63cde91 - C:\Program Files\7-Zip\Lang\el.txt -
eef960b4e335c18532941245205b8e76e68995f2f475e9d4c2748126f1ce93bd - C:\Program Files\7-Zip\Lang\eo.txt -
ee31861eeeaf64d814e12265890769390fe86cc69619ef01027f2881ace55d3c - C:\Program Files\7-Zip\Lang\fur.txt -
53518eab8193f5e926db73a6d662dc3f7418c67c1197ea0c8d24f6756c68738a - C:\Program Files\7-Zip\Lang\ky.txt -
4804e84e0852a42a67d006c3a9fc1079957af76901b344cb0160d96f713b977c - C:\bake.ps1 -
ea39bee025d99f2808d47e4c65cd722047a5e323a5fa1ad21a0a72e43f3436de - C:\Program Files\7-Zip\Lang\ru.txt -
e0c09f93fcf5e758dc782b35f10dc7d30177823ca02f344dcafe19824fb3af27 - C:\Program Files\7-Zip\Lang\fr.txt -
c8450c6795b226ceaa16ae2f6de8909b66db97623307bd1b30c4b74a5a20f0f9
Embedded URLs
- http://creativecommons.org/publicdomain/zero/1.0/
- http://www.gnu.org/software/coreutils/
- http://translationproject.org/team/
- http://gnu.org/licenses/gpl.html
- http://www.gnu.org/gethelp/
- http://www.gnu.org/licenses/
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- creativecommons.org
- geocities.com
- www.gnu.org
- translationproject.org
- gnu.org
- cygwin.com
- cwru.edu
Embedded IP addresses
- 52.178.17.234
- 52.230.60.54
- 52.123.252.203
- 48.211.4.16
- 4.230.171.124
- 135.234.160.244
- 52.110.12.30
- 52.110.12.54
File paths
- X:\windows\system32\sysreset.exe
- C:\Windows.old\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
- C:\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
- C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1120_none_c3e
- C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1_none_eedfed
- X:\SysResetTrace-Tel-Merge.etl,
- C:\$WINDOWS.~BT\Sources\Panther\SysResetTrace-Tel-Merge.etl)
More Sivis samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report