MALICIOUS — f722d94254cc7584d36582cbb3f3ebc7f89fc2c54b417b7a0b01829492f81cea

MALICIOUS — f722d94254cc7584d36582cbb3f3ebc7f89fc2c54b417b7a0b01829492f81cea is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Bulz family. 7 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: f722d94254cc7584d36582cbb3f3ebc7f89fc2c54b417b7a0b01829492f81cea
SHA-1: ca3dee6567e3e65d9972d3e44ee0b069cc77038c
MD5: 73175e1193e5bd5bdd6a2f0763d0c9cc
imphash: c36eed49d8b97cc9ea6318c04a69dbb6
ssdeep: 6144:y1db49+rEg024fpLZazEjvE/rbay19tSt4bO2BaDmeBJe/ZVMXTw:yjkArEN249AyE/rbaMct4bO2/n
TLSH: T1C1462303B6BC155FC39EAC726613221FF0E6A5FFA6396710A2D081261B82453891F793
Submitted as: f722d94254cc7584d36582cbb3f3ebc7f89fc2c54b417b7a0b01829492f81cea
File type: pe · Size: 292107 bytes
Verdict: malicious (100/100) · Family: Bulz

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Bulz-9940102-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/AutoitGenome!pz
Emsisoft (Emergency Kit): Gen:Variant.Bulz.821954
Kaspersky (KVRT): Trojan-Downloader.Win32.Agent.gpyl

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Bulz-9940102-0 (rule Win.Malware.Bulz-9940102-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/AutoitGenome!pz (rule Trojan:Win32/AutoitGenome!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Bulz.821954 (rule Gen:Variant.Bulz.821954) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Downloader.Win32.Agent.gpyl (rule Trojan-Downloader.Win32.Agent.gpyl) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 external host(s) and 26 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

28833 behavior events · 2 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61 - 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61 - e8febd20ef102c7a285c2d261fdfd48975ba810b2ca2b1a9ee8a3a253d3f0ae6
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 - 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3 - bf86f7aae9c9debd127cd430d29b953798567e04686c8ed5595b51eed228956a
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\17A440B37A6A20289A68E145191710C9 - 97f9970a9f4f3959d1d2c46920d1872762422e06d738b4862f73f6b2d094e723
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3 - 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 - de8ea62e46e22403c9771ac2bad0c48a3835f24a729a4219527dabdda9457aa2
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\XRUA1FHR\getip[1].htm - 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
C:\Program Files\Managemenot\Monitor\tcpscrex.exe - c9c65361254434af57f9f09716892351d0fb1cc22383d1ff29a855f3c1e58db6
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\17A440B37A6A20289A68E145191710C9 - 2c7d8737e577effab2e62a0610e69ac83b60dcdeba9d0a3612c429d521a77051
14201cc2da16ecf14da322c120ae875338f9046ac20b050f67c28982144b9787 - 14201cc2da16ecf14da322c120ae875338f9046ac20b050f67c28982144b9787

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://w347302.s98.ufhosted.com/getip.asp
http://www.aamailsoft.com/getip.php
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://ye2.c.lencr.org/22.crl
http://W347302.S98.Ufhosted.Com/NC/UP/Down.txt
http://c.pki.goog/r/r1.crl
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

w347302.s98.ufhosted.com
www.aamailsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
ye2.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

13.89.179.12
57.155.101.212
4.230.171.124
20.247.185.124
74.179.77.204
74.179.77.164
135.232.92.137
4.207.44.75
52.168.112.67
101.227.111.7
66.175.209.193
104.18.20.213
52.110.12.40
52.110.12.19
92.223.78.30
172.215.188.225
52.168.117.170
52.168.117.175
72.153.5.128
52.148.114.188
52.110.12.51
52.110.12.26

More Bulz samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report