MALICIOUS — 258bda2bebe56dea1f08aa8557b47cc68bffee8421de2bfe6e95aeeeb8883245

MALICIOUS — 258bda2bebe56dea1f08aa8557b47cc68bffee8421de2bfe6e95aeeeb8883245 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Ulise family. 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 258bda2bebe56dea1f08aa8557b47cc68bffee8421de2bfe6e95aeeeb8883245
SHA-1: 83047a8aa2d43b695e120c38c352a05841131f44
MD5: e91b529cdab31a8049bec3ef451c6dd4
imphash: 7732c84aec7391973c26fbc2c07a6022
ssdeep: 12288:W8bP3nCeIP6ppgg2HFZlxy3WdrRDNs8bP3nCeIP6ppgg2HFZlx6:W8OvqmT+qc8OvqmT6
TLSH: T195526BCD912F7349C2B5C6249E504E9C8866B4E9227DFA8C2A43D23F65D3C379C3506A
Submitted as: 258bda2bebe56dea1f08aa8557b47cc68bffee8421de2bfe6e95aeeeb8883245
File type: pe · Size: 971196 bytes
Verdict: malicious (100/100) · Family: Ulise

Detections (6 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Ulise-9880529-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Trojan.Ulise-9880529-0 (rule Win.Trojan.Ulise-9880529-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.30, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
Embedded network infrastructure: 1.9.0.1 - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com/0
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://crl.thawte.com/ThawtePremiumServerCA.crl0
http://crl.verisign.com/tss-ca.crl0
http://crl.thawte.com/ThawteCodeSigningCA.crl02
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com
crl.thawte.com
crl.verisign.com

Embedded IP addresses

1.9.0.1
4.150.223.99
4.230.171.124
85.210.196.11
135.232.92.137
20.165.94.54
85.210.193.152
20.42.65.90
52.253.84.76
4.144.132.223
52.230.59.222
52.168.112.67
52.168.117.168
125.56.205.42
52.110.12.48
52.110.12.19
125.56.205.32

Registry keys

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinFirewall

File paths

e:\fx19rel\WINNT_5.2_Depend\mozilla\obj-fx-trunk\toolkit\crashreporter\client\crashreporter.pdb
C:\Program
c:\vbvirus\ownerprotect.ptt
C:\905c0769f9a06c95a24ddf945\
C:\905c0769f9a06c95a24ddf945\patcher.exe

More Ulise samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report