MALICIOUS — 4dab6038acd329af87b30a5a5abff64b7f091a2ae3e38f10a4147cdef4127819

MALICIOUS — 4dab6038acd329af87b30a5a5abff64b7f091a2ae3e38f10a4147cdef4127819 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sivis family. 9 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 4dab6038acd329af87b30a5a5abff64b7f091a2ae3e38f10a4147cdef4127819
SHA-1: 1e8c1a758ee7979ae41ea2d0ddebf29120ed60c3
MD5: 00ce41e1a3300767b19fbfd404f9ba7f
imphash: 38aa7c2ff6ef0e48a9520d6702d08df4
File type: pe · Size: 410603 bytes
Verdict: malicious (100/100) · Family: Sivis

Detections (9 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Agent-6943819-1
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX 3.91
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Trellix Stinger (McAfee): PolyPatch-UPX
Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

T1112

Dynamic analysis (windows)

25478 behavior events · 1 ATT&CK techniques · 97 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/12493/files/a4475de5814a2a27da6972a62d24bcfaa90ae4035f41cc211e445cf68c14acce — a4475de5814a2a27da6972a62d24bcfaa90ae4035f41cc211e445cf68c14acce
/opt/CAPEv2/storage/analyses/12493/files/2ebdb48115c3c321762e495a4651f39102424e7e3f73f55d85988bfa5a3aab23 — 2ebdb48115c3c321762e495a4651f39102424e7e3f73f55d85988bfa5a3aab23
/opt/CAPEv2/storage/analyses/12493/files/b00d8d03deee723c114db52103e215585c8ab2830b5ba57cf389228ce9366edc — b00d8d03deee723c114db52103e215585c8ab2830b5ba57cf389228ce9366edc
/opt/CAPEv2/storage/analyses/12493/files/00dd36988c46deb7957e05a7e8520d4d0b99b9881255421bd59326c239735aa3 — 00dd36988c46deb7957e05a7e8520d4d0b99b9881255421bd59326c239735aa3
/opt/CAPEv2/storage/analyses/12493/files/3e6af3a0a64cc13ef9819641ddf749439d15f017ddb9da47ae29a39c8ee12051 — 3e6af3a0a64cc13ef9819641ddf749439d15f017ddb9da47ae29a39c8ee12051
/opt/CAPEv2/storage/analyses/12493/files/170d27f75b5a2b03eed08a7134475d66a5b5a5842ba80c28d95f90b0e14742f0 — 170d27f75b5a2b03eed08a7134475d66a5b5a5842ba80c28d95f90b0e14742f0
/opt/CAPEv2/storage/analyses/12493/files/cfd3e6eff6c617d444af0c823b49aa486d1060ad38a7f4469d605a72491c3ced — cfd3e6eff6c617d444af0c823b49aa486d1060ad38a7f4469d605a72491c3ced
/opt/CAPEv2/storage/analyses/12493/files/76e6119edd0285fdd47460e159b197bb1bc4890a2e5ab04abf474c8fbf182dc6 — 76e6119edd0285fdd47460e159b197bb1bc4890a2e5ab04abf474c8fbf182dc6
/opt/CAPEv2/storage/analyses/12493/files/dd118ebabc28901488e7234e3aaa0c9814224ef1ab0e911cc024e3027235480c — dd118ebabc28901488e7234e3aaa0c9814224ef1ab0e911cc024e3027235480c
/opt/CAPEv2/storage/analyses/12493/files/5a6d4c0e75930eb4dbfeae9833ec80becb1289e460178a65566b842d152563b7 — 5a6d4c0e75930eb4dbfeae9833ec80becb1289e460178a65566b842d152563b7
/opt/CAPEv2/storage/analyses/12493/files/93851d5200ee9601fdec0b264d23b37be03c7dedf517dc7727480a85a1a4f592 — 93851d5200ee9601fdec0b264d23b37be03c7dedf517dc7727480a85a1a4f592
/opt/CAPEv2/storage/analyses/12493/files/df18db790eb0c693598062d7eb35ff99ae3ebf28bdaa99ddbfdaeb2cf7322a08 — df18db790eb0c693598062d7eb35ff99ae3ebf28bdaa99ddbfdaeb2cf7322a08
/opt/CAPEv2/storage/analyses/12493/files/99be1da96154dbe10eb400fd37c8d50dc48256209c7d776ce3f4ad6d3cd21037 — 99be1da96154dbe10eb400fd37c8d50dc48256209c7d776ce3f4ad6d3cd21037
/opt/CAPEv2/storage/analyses/12493/files/ce048525027477851d7f1769ce803a205af7192f14b3206d025dbb446d9276c4 — ce048525027477851d7f1769ce803a205af7192f14b3206d025dbb446d9276c4
/opt/CAPEv2/storage/analyses/12493/files/0c0910578b9f13d6b54ee0c69ab2050176fe57171b552923fbb67b2138427b2a — 0c0910578b9f13d6b54ee0c69ab2050176fe57171b552923fbb67b2138427b2a

Embedded URLs

http://creativecommons.org/publicdomain/zero/1.0/
http://www.adobe.com/go/reader_system_reqs_it.UnmoveFilesRimozione
http://www.adobe.com/go/reader_system_reqs_it
https://www.digicert.com/CPS0
http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
http://www.digicert.com/ssl-cps-repository.htm0
https://d.symcb.com/rpa0
http://s.symcb.com/universal-root.crl0
https://d.symcb.com/rpa0@
http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
http://mozilla.org/MPL/2.0/
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786523928&P2=404&P3=2&P4=YXT4ZpcM7jMS16JY0VYsJVD6DpKzvvVIeMyhDPX8Ylo3wgfEyZs%2fzVUoiHAmNz%2fJpNv4Hmlz39X4RztrbCT3Pg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786523990&P2=404&P3=2&P4=SesLPt%2bsUsVf5lMpf26RSlH0IGotaLzSkDKP5GD%2faExWNLF%2f55vgOR0VNMRQ38zWCNcRRK6u3PVF87L%2bkPCRzg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

creativecommons.org
geocities.com
www.adobe.com
helpx.adobe.com
www.microsoft.com
crl3.digicert.com
crl4.digicert.com
www.digicert.com
cacerts.digicert.com
d.symcb.com
s.symcb.com
ts-crl.ws.symantec.com
ts-aia.ws.symantec.com
mozilla.org
piwik.documentfoundation.org

Embedded IP addresses

20.184.175.17
52.123.252.202
4.230.171.124
20.247.184.197
85.210.196.11
135.233.95.144
20.165.94.54
4.150.223.113
52.123.252.195
135.232.92.34
203.26.79.13
57.155.101.212
172.178.240.161
135.233.45.223
52.110.12.25
52.110.12.18
52.148.114.188
72.153.5.96
52.110.12.3
52.110.12.49

More Sivis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report