MALICIOUS — f5248426b803377cfa956b78e17ff784b41a7745cc5d4251d3c7e5ea00016095

MALICIOUS — f5248426b803377cfa956b78e17ff784b41a7745cc5d4251d3c7e5ea00016095 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Urelas family. 7 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: f5248426b803377cfa956b78e17ff784b41a7745cc5d4251d3c7e5ea00016095
SHA-1: 4ceade86c56f11981e30059871ae035bf1ab040e
MD5: 36e207eb9d0fd2ebd1daa3da5de48901
imphash: 5f36896d9fcb7695f7fb1ec7865dceff
ssdeep: 12288:WHjcoe9PH96vB/fAuBcm9TyOE/xG3muGx44MG4Yx:WDgINfAuBcgcZG2uG24MG4Y
TLSH: T16C53015DC4F223E9C7E713386F65480F68E14DE8E13F8C25588AF0205AE3667E5EA056
Submitted as: f5248426b803377cfa956b78e17ff784b41a7745cc5d4251d3c7e5ea00016095
File type: pe · Size: 1018539 bytes
Verdict: malicious (100/100) · Family: Urelas

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.MPRESS1
ClamAV (daily): Win.Trojan.Urelas-60
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:MPRESS
Microsoft Defender: Trojan:Win32/Gupboot!pz
Emsisoft (Emergency Kit): Dropped:Generic.Urelas.C3A39B5E
Kaspersky (KVRT): Rootkit.Win32.Plite.pvf

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Trojan.Urelas-60 (rule Win.Trojan.Urelas-60) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Gupboot!pz (rule Trojan:Win32/Gupboot!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dropped:Generic.Urelas.C3A39B5E (rule Dropped:Generic.Urelas.C3A39B5E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Rootkit.Win32.Plite.pvf (rule Rootkit.Win32.Plite.pvf) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MPRESS (rule DIE:MPRESS) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.MPRESS1 (rule high-entropy-sections:.MPRESS1) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
Packing/obfuscation: high-entropy-sections:.MPRESS1, MPRESS - static signal, weight 0.25, confidence 0.55
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

24764 behavior events · 2 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\~DFA3C.tmp - a1feec078022ae90b332317ca9a4e76759a5e482e4805e847164830fb3b54592
C:\Users\analyst\AppData\Local\Temp\ihpefek.exe - d6ac7d29577c50f94419a067eea59f5afa5d1391e042ab7b0b6913e55b4b9954
C:\Users\analyst\AppData\Local\Temp\lugegyl.exe - 3955406df92e2b5d082a53b142e7aa05d22c433546a1db95d335ef0811534ee5
C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - 4b48f21a4b7a02bfbec19ef880a967a02334a3cdcef8ae83de2ef327ba8bc5dd
C:\Users\analyst\AppData\Local\Temp\gbp.ini - 4a57643d2c59d1235bc0926f845583f39345839e3e9428ad619eb4b6baf96ad2
C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - 89e6b317bb07a04be3b60f542fc02302e8e6eb1327be198557b6facea5457c8c
0b2e98b9b315bac689e89d4dbb1813faac1c1f12a97f86a1148eb8a89818fb0c - 0b2e98b9b315bac689e89d4dbb1813faac1c1f12a97f86a1148eb8a89818fb0c

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

51.11.192.48
52.123.252.247
57.155.104.224
4.230.171.124
20.247.184.142
74.178.240.51
52.182.143.212
172.64.154.167
74.178.76.128
135.233.95.144
27.125.205.36
92.223.78.30
218.54.28.146
52.110.12.14
52.110.12.48
135.234.160.244
72.145.35.101
52.148.114.188
52.110.12.52
52.110.12.8

More Urelas samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report