MALICIOUS — 04ae7e55d057387885f7ba07a59b963afa13a8a05fbdcdbff02034e194b7e365

MALICIOUS — 04ae7e55d057387885f7ba07a59b963afa13a8a05fbdcdbff02034e194b7e365 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Ulise family. 7 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 04ae7e55d057387885f7ba07a59b963afa13a8a05fbdcdbff02034e194b7e365
SHA-1: b6911a98b70c29a0b792e44ed5635052c428109b
MD5: 24d4495f7f35a03b84e4b348b9e5bd8a
imphash: c6b0bd85f63e549c0536b6fceee78e43
ssdeep: 24576:qKeyxTAJj7P+yWwWAnCpzgJcqDUf5DVPBpmXGo:qKeyRA0yzW1JqDoZ7uGo
TLSH: T14D543386724050F7FB47D1DBDE319E7D244619BBACA01C145A9B04CB36D8A3BA904BF8
Submitted as: 04ae7e55d057387885f7ba07a59b963afa13a8a05fbdcdbff02034e194b7e365
File type: pe · Size: 1198033 bytes
Verdict: malicious (100/100) · Family: Ulise

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
ClamAV (daily): Win.Malware.Ulise-9787200-0
YARA: Yara-Rules community: YR_Packer_VMProtect
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Jaik!pz
Emsisoft (Emergency Kit): Gen:Variant.Barys.160809
Kaspersky (KVRT): HEUR:Trojan.Win32.Convagent.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Ulise-9787200-0 (rule Win.Malware.Ulise-9787200-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Jaik!pz (rule Trojan:Win32/Jaik!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Barys.160809 (rule Gen:Variant.Barys.160809) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Convagent.gen (rule HEUR:Trojan.Win32.Convagent.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 1 external host(s) and 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_Packer_VMProtect (rule YR_Packer_VMProtect) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Themida/VMProtect (rule Themida/VMProtect) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Themida/VMProtect, high-entropy-sections:.vmp1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

101 behavior events · 0 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Program Files (x86)\uhikioyx\usycimuspikqtr.exe - a1f8098e1341cb7f9948ed958f5bdc23c47c65b294f585690062b3978707894c
4f694dba9253b204f71d644f659a631d1bd8318f472ab1e450cae48e3e55a0fd - 4f694dba9253b204f71d644f659a631d1bd8318f472ab1e450cae48e3e55a0fd

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

s.us
yi.ch

Embedded IP addresses

20.42.73.24
52.123.252.215
52.110.12.8
52.110.12.54
4.230.171.124
20.42.179.192
52.230.59.222
74.178.240.61
20.165.94.54
52.253.84.76
104.46.162.231
172.66.2.5
172.215.188.232
52.110.12.33
125.56.205.17
52.110.12.26
125.56.205.24

File paths

Z:\X]

More Ulise samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report