MALICIOUS — 2ba5e7f6b2e07f7f19d8455cd28b0135db4c65a00e90b7ac3a37d73d4692763d
MALICIOUS — 2ba5e7f6b2e07f7f19d8455cd28b0135db4c65a00e90b7ac3a37d73d4692763d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sivis family. 8 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
2ba5e7f6b2e07f7f19d8455cd28b0135db4c65a00e90b7ac3a37d73d4692763d - SHA-1:
6c35161e560ddf008201342b40a5ecc31125f9f4 - MD5:
bc1b314ebfdea8c4f964dd847da8ec8f - imphash:
38aa7c2ff6ef0e48a9520d6702d08df4 - ssdeep:
3072:NnEOtEEqQizFhNGpWeFhNGpWxljikMTmAcThAkZThMTMz6P:TeETizFhNGpWeFhNGpWbixTmAcThAkZy - TLSH:
T13E3D5D5F1120D92FD1904A67294CE5AE5CC3E1A886B5914252CCF7B8847C83F7B2FB62 - Submitted as: 2ba5e7f6b2e07f7f19d8455cd28b0135db4c65a00e90b7ac3a37d73d4692763d
- File type: pe · Size: 134247 bytes
- Verdict: malicious (100/100) · Family: Sivis
Detections (8 of 56 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Trojan.Agent-6943819-1
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Detect It Easy (packer/type): DIE:UPX
- Microsoft Defender: Virus:Win32/Sivis.A
- Emsisoft (Emergency Kit): Win32.Sivis.A
- Trellix Stinger (McAfee): PolyPatch-UPX
- Kaspersky (KVRT): Virus.Win32.Agent.es
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 15 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Agent-6943819-1 (rule
Win.Trojan.Agent-6943819-1) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Virus:Win32/Sivis.A (rule
Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule
Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged PolyPatch-UPX (rule
PolyPatch-UPX) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Virus.Win32.Agent.es (rule
Virus.Win32.Agent.es) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
- Detect It Easy (packer/type) flagged DIE:UPX (rule
DIE:UPX) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule
UPX) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, https://www.gnu.org/software/automake/manual/automake.html, http://fsmsh.com/2753 - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
- Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Extracted generic config (4 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
18739 behavior events · 0 ATT&CK techniques · 97 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- settings-win.data.microsoft.com
- windows.msn.com
- officeclient.microsoft.com
- www.msn.com
- odc.officeapps.live.com
- assets.msn.com
Dropped files
- 5494d6ffe587e8286d4e0dbcc744fd87459b4c85928205fa3ae5d9de20549160 -
5494d6ffe587e8286d4e0dbcc744fd87459b4c85928205fa3ae5d9de20549160 - C:\Program Files\7-Zip\Lang\fr.txt -
80a1a29ce452c1410ec3f4cf391e11c43c4e658be0819d74905ced2c8cbb3cc8 - C:\Program Files\7-Zip\Lang\co.txt -
d9c14be082b5386b10f34eb3eb3435f65d48e26dcde5c6c36163648128aaf7b4 - C:\Program Files\7-Zip\Lang\ro.txt -
68acf82f2f76aa206f289715dbcaf3617a9d5ed5fffd14d8f644207e7ff62d3a - C:\Program Files\7-Zip\Lang\ext.txt -
c54de04708fd6ae25ae32d5c237c7e9fbdd745b947590f2a7b53fa7d16e3458b - C:\Program Files\7-Zip\Lang\et.txt -
6abdc38ebe2106678a888ad935b007e0c6dbd28f3980af3e64a87ac39d842b4c - C:\Program Files\7-Zip\Lang\br.txt -
754315ef70bd820ad56d219ace39b07d3356b7163a2e2cbefee393bf690d1ee6 - C:\Program Files\7-Zip\Lang\ps.txt -
acac3de9f8881e7e36bbdabe02d7ea7fde159631d8b74bdb803b9e7113deed1d - C:\Program Files\7-Zip\Lang\it.txt -
76a0431d9798254ee6f33efc21c7650b37214b28e686cc10b24871992a75e925 - C:\Program Files\7-Zip\Lang\ba.txt -
f8d2ea25019ad89999760a81b77a5c0304fb41b5c02afb7819b5b81f1f59717c - C:\Program Files\7-Zip\Lang\ko.txt -
3ad7bd229fceb7ed543989d429977cf74dd9590993005f31e608706b0ad4f3a7 - C:\$Recycle.Bin\S-1-5-21-976637724-599762485-334819845-1001\desktop.ini -
35abae95d01d5aaaa64f6546b0f42ecfb5982d9b5c06d7fbbb713f849540fba9 - C:\p.ps1 -
87ffcdceb6348dac39597b15811468b172ee17b66e84bbcc90e717bd3311d02d - C:\Program Files\7-Zip\Lang\an.txt -
9aceacfa59f7f13212b967dcc1904ddd35602258f309782df7c3b25efcad64d5 - C:\PPLFaultTemp\EventAggregationPH.dll -
19f8c4ca5755d4c21b2d47c171b5e927a280b8258af3418fed98fa89abcbaccc
Embedded URLs
- http://creativecommons.org/publicdomain/zero/1.0/
- https://www.gnu.org/software/automake/manual/automake.html
- http://fsmsh.com/2753
- https://autotools.io/index.html
- http://miller.emu.id.au/pmiller/books/rmch/
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
- http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
- http://yr.c.lencr.org/
Embedded domains
- creativecommons.org
- geocities.com
- www.gnu.org
- fsmsh.com
- autotools.io
- miller.emu.id.au
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 51.116.246.104
- 57.155.101.212
- 4.230.171.124
- 20.247.185.124
- 74.178.240.51
- 20.42.65.94
- 74.178.240.61
- 172.64.154.167
- 135.232.92.137
- 162.159.142.9
- 172.178.240.162
- 4.150.223.110
- 4.150.223.96
- 92.223.78.30
- 52.110.12.15
File paths
- X:\windows\system32\sysreset.exe
- C:\Windows.old\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
- C:\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
- C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1120_none_c3e
- C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1_none_eedfed
- X:\SysResetTrace-Tel-Merge.etl,
- C:\$WINDOWS.~BT\Sources\Panther\SysResetTrace-Tel-Merge.etl)
- C:\Windows.old
- C:\.
- C:\Windows.old\Windows\System32\Config\Software.
- C:\\Windows\System32\Config\Software.
More Sivis samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report