MALICIOUS — ecd9c5ba7f3ad3bca0be6a7ef4b64eb613cb56a7b42c1c5794e4dcdcc22a9f0a
MALICIOUS — ecd9c5ba7f3ad3bca0be6a7ef4b64eb613cb56a7b42c1c5794e4dcdcc22a9f0a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Ulise family. 5 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
ecd9c5ba7f3ad3bca0be6a7ef4b64eb613cb56a7b42c1c5794e4dcdcc22a9f0a - SHA-1:
15d8cc9b58f19a5f568f173a0e010a350c31a5c0 - MD5:
251a67224c215b94009c924f65649527 - imphash:
f119167f54171b55a9f21321e439b013 - ssdeep:
1536:Rc+gjdZzGB9bQNMeHq5ixZGLgyBmK8zccAy5mE1biojuIaWPhIgzVkQGDax2Z:RcPdZ+JsaVBzQh/9hx2 - TLSH:
T1CE3C5BC28D077012E27BE98868197AFC4492F4AD3975814D7317C80E20F767BB97236A - Submitted as: ecd9c5ba7f3ad3bca0be6a7ef4b64eb613cb56a7b42c1c5794e4dcdcc22a9f0a
- File type: pe · Size: 119311 bytes
- Verdict: malicious (96/100) · Family: Ulise
Detections (5 of 55 engines)
- ClamAV (daily): Win.Malware.Ulise-9886066-0
- YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): Generic.Dacic.1660.ECAF3920
- Kaspersky (KVRT): HEUR:Trojan.Win64.Agent.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 6 weighted signals:
- ClamAV (daily) flagged Win.Malware.Ulise-9886066-0 (rule
Win.Malware.Ulise-9886066-0) - engine signal, weight 0.90, confidence 0.95 - Contacted 43 external host(s) at runtime (58 HTTP) - network signal, weight 0.40, confidence 0.80
- YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule
STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: http://pm2pavba27wr4m34.onion/command.txt?sh1 - static signal, weight 0.35, confidence 0.60
- encrypt data (rule
encrypt data) - capa signal, weight 0.15, confidence 0.60
Dynamic analysis (windows)
1984 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Local\Temp\cached-consensus -
d90664dac6106c8255adb245939d27893330fd23ca2468a83212e7351542170d
Embedded URLs
- http://pm2pavba27wr4m34.onion/command.txt?sh1
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://131.188.40.189/tor/status-vote/current/consensus
- http://216.218.219.41/tor/server/fp/23fb753c43fca6d56157291f40c055b2dbb01d4c
- http://193.23.244.244/tor/server/fp/84a437a564dc8770f55f4ceb86738801322400ac
- http://193.23.244.244/tor/server/fp/8aec260411bd097b419d1a8a244e5297c03c1ad8
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787830864&P2=404&P3=2&P4=nncHy4Y5XDaxIw1zYML73vgjvlWVgHIZXXRZ%2fzLSGGs4SKv0vKBVnCS3hmLdD9%2buojIWzAKPB%2fqG3vyQG6M98A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://204.13.164.118/tor/server/fp/724f4622ea76583af64614979db847dd39eea61b
- http://193.23.244.244/tor/server/fp/9383af4a99840ee5bf5a4ecc07b6d6d401ea55b5
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://193.23.244.244/tor/server/fp/890b4cec1e53c3b91a21e043dde3f2eb8c6bba5b
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787830907&P2=404&P3=2&P4=DgszVIbSdot%2f8HN7AGc9%2fbiF8uXMd%2b0vml8rypbo1Xbfr6GJi0dzYH8o501KnzMAqO3c9%2fyZvLUNr6TxRD3utg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://216.218.219.41/tor/server/fp/40f05a1a3d57357d2366d317b96c8b5e4bd628be
- http://216.218.219.41/tor/server/fp/9747b6e32be7af85ec2606d296dac8206202bc92
- http://193.23.244.244/tor/server/fp/9433b42f5282dfa0b4d3065d34e65fe13680b98a
- http://193.23.244.244/tor/server/fp/bd070acafd8bca29d5075e7957a0092703543806
- http://204.13.164.118/tor/server/fp/7fe5143d6601c5ab5ecd454f48c36d71d0d96971
- http://204.13.164.118/tor/server/fp/bfbbc4b5d7eb2e0f6dce9c64848caebd7283f4d5
- http://216.218.219.41/tor/server/fp/1a25c6358db91342aa51720a5038b72742732498
- http://204.13.164.118/tor/server/fp/2ce95616375dd0292bc72a384f4345f685469b30
- http://193.23.244.244/tor/server/fp/da13887bbab6d62e6a7635e71c7331baafc5f1b7
- http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
Embedded domains
- pm2pavba27wr4m34.onion
Embedded IP addresses
- 52.123.252.192
- 20.42.65.84
- 52.253.84.76
- 4.230.171.124
- 85.210.196.11
- 135.232.92.137
- 135.233.95.135
- 20.42.73.30
- 20.165.94.63
- 20.236.44.162
- 52.123.129.14
- 52.123.128.14
- 135.234.160.244
- 131.188.40.189
- 216.218.219.41
- 64.65.62.164
- 193.23.244.244
- 64.65.2.76
- 104.237.134.95
- 204.13.164.118
- 203.26.79.13
- 109.70.100.245
- 47.77.211.199
- 74.179.71.159
- 52.148.114.188
More Ulise samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report