MALICIOUS — eb3ea6229a5989b77beb748fe59e6adfe064d224ee6a5ba17910dcbeec27f519
MALICIOUS — eb3ea6229a5989b77beb748fe59e6adfe064d224ee6a5ba17910dcbeec27f519 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Unruy family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.
Identification
- SHA-256:
eb3ea6229a5989b77beb748fe59e6adfe064d224ee6a5ba17910dcbeec27f519 - SHA-1:
835308dc56532f6ded60f615ffcfdd57d62e580a - MD5:
396136ea4409358d392e0e2083ade58b - imphash:
53b338a5a343440770be2403e59415fb - ssdeep:
6144:1mSUslh44d5nngQFZJ6RbxLj2JZz0uf8lBd5mTMNRXDgEQNB+xALl9ZchoMF4fQq:1mLsla4bgL7LqZ3Mz6Mepl9Shbjztxu - TLSH:
T14349AF26162ABE78D72F3F255824FB0FB613993F91EC241512818B2E761815FE3D4239 - Submitted as: eb3ea6229a5989b77beb748fe59e6adfe064d224ee6a5ba17910dcbeec27f519
- File type: pe · Size: 406450 bytes
- Verdict: malicious (100/100) · Family: Unruy
Detections (5 of 56 engines)
- ClamAV (daily): Win.Downloader.Unruy-6988793-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: TrojanDownloader:Win32/Unruy!pz
- Emsisoft (Emergency Kit): Gen:Variant.Unruy.1
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 13 weighted signals:
- ClamAV (daily) flagged Win.Downloader.Unruy-6988793-0 (rule
Win.Downloader.Unruy-6988793-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged TrojanDownloader:Win32/Unruy!pz (rule
TrojanDownloader:Win32/Unruy!pz) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.Unruy.1 (rule
Gen:Variant.Unruy.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule
HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: 94.75.229.248 - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 4 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 5528) (rule
windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
343 behavior events · 0 ATT&CK techniques · 5 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- windows.msn.com
- www.msn.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- th.bing.com
- watson.events.data.microsoft.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
Dropped files
- C:\Users\analyst\AppData\Local\microsoft\OneDrive\onedrive.exe -
19b068927a67b6e97eeb30509d5dbef9d079dd217c3186eeefe531cd64985c69 - C:\program files (x86)\internet explorer\wmpscfgs.exe -
d80cb436896f35674b3860a1373a37ff1f7b3df657d86e382c62e4322dd2f17e - C:\program files (x86)\Adobe\acrotray .exe -
4681b6da7f8edf5ce0db2173a79da32e715a5c76c2fe720bff44406ac136ddce - C:\program files (x86)\Adobe\acrotray.exe -
7349b73784f41b6b929fb0bfc254c4829f21fcbe96ec297618e2e1e483d862fd - 42c113ed71e479904e8217a319b173f5caf14171de43eff261b85c2bf18f6771 -
42c113ed71e479904e8217a319b173f5caf14171de43eff261b85c2bf18f6771
Embedded URLs
- http://www.google.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- www.supernetforme.com
- www.superwebbysearch.com
- www.google.com
Embedded IP addresses
- 94.75.229.248
- 20.247.184.197
- 51.105.71.136
- 52.123.252.248
- 4.230.171.124
- 172.64.154.167
- 135.233.45.222
- 52.110.12.37
File paths
- c:\program
- C:\Program
More Unruy samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report