MALICIOUS — 489673e1faa79ff95814c43809d6f26371cdb154fba83970fb235b944c07f080
MALICIOUS — 489673e1faa79ff95814c43809d6f26371cdb154fba83970fb235b944c07f080 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Container family. 9 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
489673e1faa79ff95814c43809d6f26371cdb154fba83970fb235b944c07f080 - SHA-1:
f367b7ec9402c3ad213af97d92aff73af347af4e - MD5:
d4ac0293c3655c6fe1291ae69967eb6a - imphash:
38aa7c2ff6ef0e48a9520d6702d08df4 - File type: pe · Size: 439612 bytes
- Verdict: malicious (98/100) · Family: Container
Detections (9 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Trojan.Agent-6943819-1
- YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Detect It Easy (packer/type): DIE:UPX 3.91
- Kaspersky (KVRT): Virus.Win32.Agent.es
- Microsoft Defender: Virus:Win32/Sivis.A
- Emsisoft (Emergency Kit): Win32.Sivis.A
- Trellix Stinger (McAfee): PolyPatch-UPX
MITRE ATT&CK
Dynamic analysis (windows)
25483 behavior events · 1 ATT&CK techniques · 97 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- settings-win.data.microsoft.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- licensing.mp.microsoft.com
- assets.msn.com
- www.bing.com
- tas02.sls.update.microsoft.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/11986/files/7caf4c5f4a7a983354d5e836c0a4cbb2102b3143859fd11a8ff960de720b5359 —
7caf4c5f4a7a983354d5e836c0a4cbb2102b3143859fd11a8ff960de720b5359 - /opt/CAPEv2/storage/analyses/11986/files/bdf8acf6ff486d5d4317deed30e5ba4dcccd8face3e59afb4cbedbfa80f860aa —
bdf8acf6ff486d5d4317deed30e5ba4dcccd8face3e59afb4cbedbfa80f860aa - /opt/CAPEv2/storage/analyses/11986/files/9e43184f0545445b0983ae2370e6119e11a2b1fb1a4de02ce7b79c4a34a0f206 —
9e43184f0545445b0983ae2370e6119e11a2b1fb1a4de02ce7b79c4a34a0f206 - /opt/CAPEv2/storage/analyses/11986/files/e7dee33a33cdbed751ed69a06e2dbb746485b815f362c476b2e14298f8bdd7ca —
e7dee33a33cdbed751ed69a06e2dbb746485b815f362c476b2e14298f8bdd7ca - /opt/CAPEv2/storage/analyses/11986/files/d2c08920291ea08130e6ee99b56885b7ba307c92cf360c307e22ac27579de033 —
d2c08920291ea08130e6ee99b56885b7ba307c92cf360c307e22ac27579de033 - /opt/CAPEv2/storage/analyses/11986/files/65f713980d5f554da9fd66253e43490e189658d922faf25db8823fd4d9acde96 —
65f713980d5f554da9fd66253e43490e189658d922faf25db8823fd4d9acde96 - /opt/CAPEv2/storage/analyses/11986/files/4eb393ff84a44d6362fb714f143452f65b44d725e0aaaf50ccb7befb6d315781 —
4eb393ff84a44d6362fb714f143452f65b44d725e0aaaf50ccb7befb6d315781 - /opt/CAPEv2/storage/analyses/11986/files/74b35b595422f502d2f3aa78636633c0107d871157e0a1ae16cf4eea94dfc682 —
74b35b595422f502d2f3aa78636633c0107d871157e0a1ae16cf4eea94dfc682 - /opt/CAPEv2/storage/analyses/11986/files/f73379244cf1353e569ddc8702bd37640d306ad48b079d941080d34e6b89d0b0 —
f73379244cf1353e569ddc8702bd37640d306ad48b079d941080d34e6b89d0b0 - /opt/CAPEv2/storage/analyses/11986/files/755994536a38a7f427b0e4080b40d91e081198d0e5b5c3f953c5de910cace95f —
755994536a38a7f427b0e4080b40d91e081198d0e5b5c3f953c5de910cace95f - /opt/CAPEv2/storage/analyses/11986/files/e264c0940ac9b37965da01528bded0801992ba1c5ac5901126a82e03f1df9363 —
e264c0940ac9b37965da01528bded0801992ba1c5ac5901126a82e03f1df9363 - /opt/CAPEv2/storage/analyses/11986/files/3464db53c9d8fea5c7c1c2289496c57deb22d1778e221d6ea3daaed6b4e36f42 —
3464db53c9d8fea5c7c1c2289496c57deb22d1778e221d6ea3daaed6b4e36f42 - /opt/CAPEv2/storage/analyses/11986/files/7962ea9e9e8df8f112bb54c1b2c705f87005d1530eebdbe14bbf56e6c16d88a6 —
7962ea9e9e8df8f112bb54c1b2c705f87005d1530eebdbe14bbf56e6c16d88a6 - /opt/CAPEv2/storage/analyses/11986/files/4ee4450fd2a30c53f21a2427d7f25ab9b26f84e6ad50f26e90e0f05971726387 —
4ee4450fd2a30c53f21a2427d7f25ab9b26f84e6ad50f26e90e0f05971726387 - /opt/CAPEv2/storage/analyses/11986/files/b7395ab8235340fbe88dc461affc9e775d48fe5d4f6ac715c6882bac95f22fff —
b7395ab8235340fbe88dc461affc9e775d48fe5d4f6ac715c6882bac95f22fff
Embedded URLs
- http://creativecommons.org/publicdomain/zero/1.0/
- http://www.adobe.com/go/reader_system_reqs_it.UnmoveFilesRimozione
- http://www.adobe.com/go/reader_system_reqs_it
- https://www.digicert.com/CPS0
- http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
- http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
- http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
- http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
- http://www.digicert.com/ssl-cps-repository.htm0
- https://d.symcb.com/rpa0
- http://s.symcb.com/universal-root.crl0
- https://d.symcb.com/rpa0@
- http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
- http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786507045&P2=404&P3=2&P4=OHIzMrhVRWPlxa%2bUjx2IPQRzPAtaRLIaSY6uAJwwE92BRZtX%2fEHMl9RQ6INblKNLoyZ8q3ZdMVW%2bG6MYEh09AA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- creativecommons.org
- geocities.com
- www.adobe.com
- helpx.adobe.com
- www.microsoft.com
- crl3.digicert.com
- crl4.digicert.com
- www.digicert.com
- cacerts.digicert.com
- d.symcb.com
- s.symcb.com
- ts-crl.ws.symantec.com
- ts-aia.ws.symantec.com
Embedded IP addresses
- 51.116.246.104
- 57.155.104.224
- 4.230.171.124
- 52.230.60.54
- 135.233.95.144
- 135.232.92.97
- 20.42.73.26
- 135.232.92.137
- 172.178.240.163
- 20.184.175.4
- 20.42.65.84
- 203.26.79.13
- 74.179.71.159
- 135.234.160.246
- 72.154.7.104
- 52.110.12.55
More Container samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report