MALICIOUS — 2f2629177f43b94ffd23098587ac8815d38e69aad2c31c1dfdb63de33e96b3ef

MALICIOUS — 2f2629177f43b94ffd23098587ac8815d38e69aad2c31c1dfdb63de33e96b3ef is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the ShipUp family. 7 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 2f2629177f43b94ffd23098587ac8815d38e69aad2c31c1dfdb63de33e96b3ef
SHA-1: 407e64b201f63ca5c54b96657d8e85f22a7d1a0f
MD5: 154079b49666f838e4b6059981e399f5
imphash: 42db3a9eec38e38518b0e27d21bdf33d
ssdeep: 3072:2CMiqJl3v1S4AsvdhxBz8bNk/AKItB/pL/s9hlSLUFWzr:2CMzfM4vxBIO+XpDnUUzr
TLSH: T1DD3FD0B373809DA0F640CD397A79065C73CB81A0052D056ADEFB847477E58ABC25AD9C
Submitted as: 2f2629177f43b94ffd23098587ac8815d38e69aad2c31c1dfdb63de33e96b3ef
File type: pe · Size: 151528 bytes
Verdict: malicious (100/100) · Family: ShipUp

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): LCC-Win32
ClamAV (daily): Win.Packed.Ulise-7131547-0
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:LCC-Win32
Microsoft Defender: TrojanDropper:Win32/Gepys.A
Emsisoft (Emergency Kit): Gen:Variant.Zusy.408193
Kaspersky (KVRT): HEUR:Trojan.Win32.ShipUp.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Packed.Ulise-7131547-0 (rule Win.Packed.Ulise-7131547-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged TrojanDropper:Win32/Gepys.A (rule TrojanDropper:Win32/Gepys.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Zusy.408193 (rule Gen:Variant.Zusy.408193) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.ShipUp.gen (rule HEUR:Trojan.Win32.ShipUp.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:LCC-Win32 (rule DIE:LCC-Win32) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged LCC-Win32 (rule LCC-Win32) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
Packing/obfuscation: LCC-Win32 - static signal, weight 0.25, confidence 0.55
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

2610 behavior events · 1 ATT&CK techniques · 5 dropped files.

Dropped files

C:\ProgramData\Mozilla\xboudmj.dll - f0fd0b57ca429603e4615329c3e382b1ab3aaf974c14e64512c8295c6f868066
C:\ProgramData\Mozilla\tljrkni.exe - 0d48ecfbcfc3f5c3ab8c9dea4e18715c3ee4c389a1c8a2be1f6e1a0f29f44ec2
65ddc326992a5de80c75258965e499976363944bc2b9e594263a5af14deb4ce7 - 65ddc326992a5de80c75258965e499976363944bc2b9e594263a5af14deb4ce7
1f3a975c16963ac047ac7d8c3d069da04219dc942ca42b819be26e5e6a6ccd16 - 1f3a975c16963ac047ac7d8c3d069da04219dc942ca42b819be26e5e6a6ccd16
30e4f63e9472caa060e44e57cf2ff66ce1afaa850b1f6decfa6892ceae1a4d07 - 30e4f63e9472caa060e44e57cf2ff66ce1afaa850b1f6decfa6892ceae1a4d07

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

52.168.112.67
52.230.59.222
52.123.252.238
4.230.171.124
172.64.154.167
172.66.2.5
20.184.175.10
52.182.143.212
172.215.188.225
52.110.12.53
52.148.114.188
72.154.7.107
52.110.12.16

More ShipUp samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report