MALICIOUS — 2660821dba1e02b2427e40739b8fa786ad868d11913d57344775bdbd7bb7249c

MALICIOUS — 2660821dba1e02b2427e40739b8fa786ad868d11913d57344775bdbd7bb7249c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sivis family. 9 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 2660821dba1e02b2427e40739b8fa786ad868d11913d57344775bdbd7bb7249c
SHA-1: 84e2e92ab797ef2ec9a8d376045380dc451d8e58
MD5: ebf1d4e639e45a904868e1a3fafa5706
imphash: 38aa7c2ff6ef0e48a9520d6702d08df4
File type: pe · Size: 410522 bytes
Verdict: malicious (100/100) · Family: Sivis

Detections (9 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Agent-6943819-1
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX 3.91
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Trellix Stinger (McAfee): PolyPatch-UPX
Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

T1112

Dynamic analysis (windows)

25479 behavior events · 1 ATT&CK techniques · 97 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/12529/files/ab4cff09db48eba292724d465abdc413a1910f3ef6850e5acfdf8cda32c3a2be — ab4cff09db48eba292724d465abdc413a1910f3ef6850e5acfdf8cda32c3a2be
/opt/CAPEv2/storage/analyses/12529/files/f5e54369af95e18de38882919e23d165838afda2122fab4edaaa54099b5b28ff — f5e54369af95e18de38882919e23d165838afda2122fab4edaaa54099b5b28ff
/opt/CAPEv2/storage/analyses/12529/files/8265813da1133a2e07b3fcd4150dda46d5bc804b177441d4aefea2e1314375d6 — 8265813da1133a2e07b3fcd4150dda46d5bc804b177441d4aefea2e1314375d6
/opt/CAPEv2/storage/analyses/12529/files/abf9d0761d2e0b8141764b2b6f356fb4de922575d30aa7698d7ad9bea6d9775a — abf9d0761d2e0b8141764b2b6f356fb4de922575d30aa7698d7ad9bea6d9775a
/opt/CAPEv2/storage/analyses/12529/files/fd68fdad6590ebc045f2bf9dc6f6f4187fded8eabb686ee6cb8adbaaed659c70 — fd68fdad6590ebc045f2bf9dc6f6f4187fded8eabb686ee6cb8adbaaed659c70
/opt/CAPEv2/storage/analyses/12529/files/f5dfa6c42ee7e7cef9e2e79a61d5215078ca5957134750a061389aef2441af28 — f5dfa6c42ee7e7cef9e2e79a61d5215078ca5957134750a061389aef2441af28
/opt/CAPEv2/storage/analyses/12529/files/f798a227255729a83687e25f234bd3da3c9ac4167a54d4405a776f385b94d782 — f798a227255729a83687e25f234bd3da3c9ac4167a54d4405a776f385b94d782
/opt/CAPEv2/storage/analyses/12529/files/e9ed7f9e3b4c917dc2fe5c168947f21ac1171e98babfd2b5b77ddbafb2ebfa61 — e9ed7f9e3b4c917dc2fe5c168947f21ac1171e98babfd2b5b77ddbafb2ebfa61
/opt/CAPEv2/storage/analyses/12529/files/c9d7c3087b29441d420c7320585b4a98490cc8a12fe5d9d28a8d579c56c1e42c — c9d7c3087b29441d420c7320585b4a98490cc8a12fe5d9d28a8d579c56c1e42c
/opt/CAPEv2/storage/analyses/12529/files/c63376c1a26009190ebb487e243dc0368ff972880b9b49e7988e526c85e352d1 — c63376c1a26009190ebb487e243dc0368ff972880b9b49e7988e526c85e352d1
/opt/CAPEv2/storage/analyses/12529/files/c0f13bd594f2202600afbafa07d6ce6ed54ca065a161ad5740c0561b39321b5f — c0f13bd594f2202600afbafa07d6ce6ed54ca065a161ad5740c0561b39321b5f
/opt/CAPEv2/storage/analyses/12529/files/deb0d878b1f3849594b7bfa10fe0c82721de66bd2a7a9823d8e18bd64cc81aa7 — deb0d878b1f3849594b7bfa10fe0c82721de66bd2a7a9823d8e18bd64cc81aa7
/opt/CAPEv2/storage/analyses/12529/files/de5f6598e2f83ae5ab2377f00ae5a8ce2bba705f63d3e8a65974b874621401d2 — de5f6598e2f83ae5ab2377f00ae5a8ce2bba705f63d3e8a65974b874621401d2
/opt/CAPEv2/storage/analyses/12529/files/a69a4f8eb79e3c71c46c16985d729cac94463a11ebb5b930dcdaef3d93138cbb — a69a4f8eb79e3c71c46c16985d729cac94463a11ebb5b930dcdaef3d93138cbb
/opt/CAPEv2/storage/analyses/12529/files/61a36d999ac238288587fa351879f871905cd664d36cb19bf570f0a436ee163a — 61a36d999ac238288587fa351879f871905cd664d36cb19bf570f0a436ee163a

Embedded URLs

http://creativecommons.org/publicdomain/zero/1.0/
http://www.adobe.com/go/reader_system_reqs_it.UnmoveFilesRimozione
http://www.adobe.com/go/reader_system_reqs_it
https://www.digicert.com/CPS0
http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
http://www.digicert.com/ssl-cps-repository.htm0
https://d.symcb.com/rpa0
http://s.symcb.com/universal-root.crl0
https://d.symcb.com/rpa0@
http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
http://mozilla.org/MPL/2.0/
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786524869&P2=404&P3=2&P4=l7QKOG98LxHI%2bVNQFZBVUPZCJLb5T0jyurK7GWY6ec1hunhByBGb7YU76QIK9nJAaPsvyJWaI0l6gAyPbf78YA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

creativecommons.org
geocities.com
www.adobe.com
helpx.adobe.com
www.microsoft.com
crl3.digicert.com
crl4.digicert.com
www.digicert.com
cacerts.digicert.com
d.symcb.com
s.symcb.com
ts-crl.ws.symantec.com
ts-aia.ws.symantec.com
mozilla.org
piwik.documentfoundation.org
aefd.nelreports.net

Embedded IP addresses

142.250.195.131
4.150.223.102
52.123.252.203
4.230.171.124
20.42.179.204
52.230.60.54
74.178.240.61
20.165.94.54
52.182.141.63
13.89.179.12
135.234.160.245
203.26.79.13
135.232.92.34
92.223.78.30
135.233.45.221
57.155.101.212
20.42.65.89
20.42.73.28
72.154.7.100
52.110.12.32
52.110.12.14
52.148.114.188
74.179.77.204
135.234.160.246
48.199.12.1

More Sivis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report