MALICIOUS — 54ab65c8dd2c8eb1b6354117aac7c647ed6277898f49ebdea6dc4a98b7a5cb3f
MALICIOUS — 54ab65c8dd2c8eb1b6354117aac7c647ed6277898f49ebdea6dc4a98b7a5cb3f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Container family. 9 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
54ab65c8dd2c8eb1b6354117aac7c647ed6277898f49ebdea6dc4a98b7a5cb3f - SHA-1:
6e2a30515a0205a83a429d1140fd07f7759d413e - MD5:
e23aeb30a98b7a8593041f76cbe50a9a - imphash:
38aa7c2ff6ef0e48a9520d6702d08df4 - File type: pe · Size: 447795 bytes
- Verdict: malicious (98/100) · Family: Container
Detections (9 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Trojan.Agent-6943819-1
- YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Detect It Easy (packer/type): DIE:UPX 3.91
- Microsoft Defender: Virus:Win32/Sivis.A
- Emsisoft (Emergency Kit): Win32.Sivis.A
- Trellix Stinger (McAfee): PolyPatch-UPX
- Kaspersky (KVRT): Virus.Win32.Agent.es
MITRE ATT&CK
Dynamic analysis (windows)
25483 behavior events · 1 ATT&CK techniques · 97 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- msedge.api.cdp.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
- kv801.prod.do.dsp.mp.microsoft.com
- cp801.prod.do.dsp.mp.microsoft.com
- msedge.b.tlu.dl.delivery.mp.microsoft.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- _dosvc._tcp.local
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- licensing.mp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
- settings-win.data.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/11607/files/65ab6e010447bcc41c58e926a8e640f95be0e7ed62430d7031070b7cb2420edb —
65ab6e010447bcc41c58e926a8e640f95be0e7ed62430d7031070b7cb2420edb - /opt/CAPEv2/storage/analyses/11607/files/ee5b32183ba363548cebf3a0f73a3aeef96f254a75cc94265c990a434254bdd0 —
ee5b32183ba363548cebf3a0f73a3aeef96f254a75cc94265c990a434254bdd0 - /opt/CAPEv2/storage/analyses/11607/files/3830643809060e2af1efa0b314f137373efff3f767fc0804d51b9e17ec90f208 —
3830643809060e2af1efa0b314f137373efff3f767fc0804d51b9e17ec90f208 - /opt/CAPEv2/storage/analyses/11607/files/c04745f48291486bffefccc900cd677000fddc60b0515a771c21f95d7e4673d3 —
c04745f48291486bffefccc900cd677000fddc60b0515a771c21f95d7e4673d3 - /opt/CAPEv2/storage/analyses/11607/files/01e6794cd47af15a5c7ab58b334c577c0676ff7d097756a4f382bfb3ba7fe3fd —
01e6794cd47af15a5c7ab58b334c577c0676ff7d097756a4f382bfb3ba7fe3fd - /opt/CAPEv2/storage/analyses/11607/files/80d5985ca6806e7fa89a4c46544dd4c70aa9fbe43e269c8bbc454968966305ae —
80d5985ca6806e7fa89a4c46544dd4c70aa9fbe43e269c8bbc454968966305ae - /opt/CAPEv2/storage/analyses/11607/files/94e702ce40f4d27698bba85b2d89a0aec2d044de7556a8e0bd35b64c2473747f —
94e702ce40f4d27698bba85b2d89a0aec2d044de7556a8e0bd35b64c2473747f - /opt/CAPEv2/storage/analyses/11607/files/59ce6e230a7e53c3c540b39d0cd38814f9aa7092ff228697598f679ed859122a —
59ce6e230a7e53c3c540b39d0cd38814f9aa7092ff228697598f679ed859122a - /opt/CAPEv2/storage/analyses/11607/files/8822b1de1dbe5e5691e0babe6b6e8fbe93e40c5ee7edad92afe8c1587342f8c2 —
8822b1de1dbe5e5691e0babe6b6e8fbe93e40c5ee7edad92afe8c1587342f8c2 - /opt/CAPEv2/storage/analyses/11607/files/ada3cafc5dfb30537eed180a96b5720d68f97e22b3addc930d298f9076a1c84e —
ada3cafc5dfb30537eed180a96b5720d68f97e22b3addc930d298f9076a1c84e - /opt/CAPEv2/storage/analyses/11607/files/0d782d4fe372dcdab78da9fbeb7047d6417c71248540be11bf5ecd829086cf30 —
0d782d4fe372dcdab78da9fbeb7047d6417c71248540be11bf5ecd829086cf30 - /opt/CAPEv2/storage/analyses/11607/files/1cb611e4dbf3401a0cb0b5940ae2a5a830273096b11de32d837c3f49de41801a —
1cb611e4dbf3401a0cb0b5940ae2a5a830273096b11de32d837c3f49de41801a - /opt/CAPEv2/storage/analyses/11607/files/292ec8edd3b055d0fc8a3e9148eb4ccbf4a86bff42a96f5954d1895dd3cefcf4 —
292ec8edd3b055d0fc8a3e9148eb4ccbf4a86bff42a96f5954d1895dd3cefcf4 - /opt/CAPEv2/storage/analyses/11607/files/2efee77ea813707b59fc87d1e1f0cac496833dc6aeb7009c8ae1801270a3d1e9 —
2efee77ea813707b59fc87d1e1f0cac496833dc6aeb7009c8ae1801270a3d1e9 - /opt/CAPEv2/storage/analyses/11607/files/33e87ff2201641f93deda2d5596002e8e976f84a105a02c5186b4b3ae2bbdd30 —
33e87ff2201641f93deda2d5596002e8e976f84a105a02c5186b4b3ae2bbdd30
Embedded URLs
- http://creativecommons.org/publicdomain/zero/1.0/
- http://www.adobe.com/go/reader_system_reqs_it.UnmoveFilesRimozione
- http://www.adobe.com/go/reader_system_reqs_it
- https://www.digicert.com/CPS0
- http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
- http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
- http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
- http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
- http://www.digicert.com/ssl-cps-repository.htm0
- https://d.symcb.com/rpa0
- http://s.symcb.com/universal-root.crl0
- https://d.symcb.com/rpa0@
- http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
- http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
- http://mozilla.org/MPL/2.0/
- http://www.apache.org/licenses/LICENSE-2.0
- http://www.w3.org/1999/XSL/Transform
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786488862&P2=404&P3=2&P4=Av86lHlD7siEfwqLcUiDcGu%2f2j%2bysUKaK0Be4GwsvPdNqFX1eQw76axgrqeYkSKWeq7L59r59vFEeOg3yQHzsg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786488918&P2=404&P3=2&P4=cfFLYgkM6JJ2MavpjoXXrEDGbI9k%2bbqZYGOcyLt2BUN9NEGQzN2AC0XsxXv8806hZ6%2bipphGuzI5CSeqS5Q8zQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- creativecommons.org
- geocities.com
- www.adobe.com
- helpx.adobe.com
- www.microsoft.com
- crl3.digicert.com
- crl4.digicert.com
- www.digicert.com
- cacerts.digicert.com
- d.symcb.com
- s.symcb.com
- ts-crl.ws.symantec.com
- ts-aia.ws.symantec.com
- mozilla.org
- piwik.documentfoundation.org
- www.apache.org
- www.w3.org
Embedded IP addresses
- 20.42.73.27
- 203.26.79.13
- 20.247.184.197
- 4.230.171.124
- 85.210.193.152
- 48.211.4.16
- 135.232.92.34
- 135.233.95.144
- 135.233.95.135
- 40.79.141.153
- 135.233.45.221
- 72.153.5.60
- 135.233.45.222
- 20.165.94.46
- 52.110.12.49
- 52.110.12.24
- 52.148.114.188
- 135.234.160.244
- 48.199.12.1
- 52.178.17.3
- 172.170.180.133
- 51.116.253.170
- 52.110.12.51
More Container samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report