MALICIOUS — d96e06afeacc973a0cbf2150e10fb33c63b25f8f2f3f47c1447a52293e1ab52a

MALICIOUS — d96e06afeacc973a0cbf2150e10fb33c63b25f8f2f3f47c1447a52293e1ab52a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sivis family. 9 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: d96e06afeacc973a0cbf2150e10fb33c63b25f8f2f3f47c1447a52293e1ab52a
SHA-1: 9a65e224dadfb26435be8ff6c11bf3215e1e4b7a
MD5: 547808a2b1b7b0002f8bd7dec95dea68
imphash: 38aa7c2ff6ef0e48a9520d6702d08df4
ssdeep: 768:41uAkERoZtpcVK2Eq3GcOnieOTJwYf2mGGAHwvLtBu3iqboOYYYYYYYYYYYYYYY:40nERoZtEEq3GcOieOTeY+TGx7W
TLSH: T1273A5C56119241BFD2F69E921C4CCE0C8043B0F9B1BD0BEED20BD99C85E7DB3A5A5492
Submitted as: d96e06afeacc973a0cbf2150e10fb33c63b25f8f2f3f47c1447a52293e1ab52a
File type: pe · Size: 95839 bytes
Verdict: malicious (100/100) · Family: Sivis

Detections (9 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Agent-6943819-1
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Trellix Stinger (McAfee): PolyPatch-UPX
Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-6943819-1 (rule Win.Trojan.Agent-6943819-1) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Sivis.A (rule Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PolyPatch-UPX (rule PolyPatch-UPX) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Agent.es (rule Virus.Win32.Agent.es) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.55, confidence 0.70
Contacted 3 external host(s) and 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, http://www.gnu.org/software/coreutils/, http://translationproject.org/team/ - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

19095 behavior events · 0 ATT&CK techniques · 97 dropped files.

Dropped files

C:\Program Files\7-Zip\Lang\gl.txt - a48abe4bdccb56d1e2127d6938a34afb087509f907abb32142df4bf4782acace
C:\Program Files\7-Zip\descript.ion - 5f2005130db904813076a8c2790e75806f665db84caf93c5d8623a88496e9c8f
C:\Program Files\7-Zip\Lang\br.txt - 597d279e6c1832fe94887a66ab81530227ee524eecc6a84747bb42931ec9b523
C:\796.ini - 2127a63f8df7d61fb07a4788cf2b9d65e12c62e67693113b87f0a07061cce9c3
C:\Program Files\7-Zip\Lang\cy.txt - 05a5d28b0c80e3ab272f63df11e832c1ce25da86fac061db672fafb4b704d8a2
C:\Program Files\7-Zip\History.txt - 6e7fd0481279240be48330f50f6b8753a9348b64aeec62bff2e65da653a823a9
C:\Program Files\7-Zip\7z.sfx - fd9f07ad107b5fce6626fd58444e723ef295ec34b9c8be210435594eebc87ffa
C:\Program Files\7-Zip\Lang\is.txt - 4ee2ed20ea4151a10f112b3128371d9682899733c36023c5b00b10b71cd83a8b
C:\Program Files\7-Zip\Lang\co.txt - d2a0bd00525fc7769798b1f08a6e4b2383c82fffdbe7466bb92b49e3aa544c6e
C:\Program Files\7-Zip\7-zip.dll - 7a83d8d3e9b93a2b23e2a5e0fe4c4d36e69e7ba3b0ed41511f57088116de78ff
C:\Program Files\7-Zip\Lang\ps.txt - cbdfe4645b85ef57621310201a9f0e3699a6b663a5b3a66cf51f249d993cb404
C:\Program Files\7-Zip\Lang\ne.txt - 72440f64d314493a7183ee9d870ff27def20df8e76df6c23b65f04f238bbad14
C:\Program Files\7-Zip\7zCon.sfx - 58595a779c76f9c63a08fc9d32bc5595147efd09cd53eed388afd46783ca97fd
C:\PPLFaultTemp\EventAggregationPH.dll - 3c0d22488cc0882b42de96fa260bd369e0423484c2dd0fe2425a12b0de9363f7
C:\Program Files\7-Zip\7-zip.chm - 4240b51084e132647c45414d68bd2060a4f38ed1efdd7be0cac8126be9518d03

Embedded URLs

http://creativecommons.org/publicdomain/zero/1.0/
http://www.gnu.org/software/coreutils/
http://translationproject.org/team/
http://gnu.org/licenses/gpl.html
http://www.gnu.org/gethelp/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

creativecommons.org
www.gnu.org
translationproject.org
gnu.org
cygwin.com

Embedded IP addresses

4.150.223.107
52.123.252.222
20.42.179.204
4.230.171.124
172.215.188.225
74.178.76.128
52.253.84.76
135.232.92.97
4.150.223.115
74.179.77.204
104.18.33.89
135.233.45.223
52.110.12.52
57.150.192.97
52.110.12.46
135.234.160.246
52.110.12.40
52.110.12.10

File paths

C:\Users\Public\Desktop\LibreOffice

More Sivis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report