MALICIOUS — 5a301bef3f6013e2e6c4353ab19447234f0ec196e5c292393f53c3dcb203d192

MALICIOUS — 5a301bef3f6013e2e6c4353ab19447234f0ec196e5c292393f53c3dcb203d192 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Ulise family. 8 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 5a301bef3f6013e2e6c4353ab19447234f0ec196e5c292393f53c3dcb203d192
SHA-1: 9b5ed3292f090c68d95d62be28ecbdd5c3a1c50f
MD5: 8aca2d2dfe84cc400bbc904c7ac98a25
imphash: a5491ddab3ab64c1c40fad74c1ea58b8
ssdeep: 49152:dqgazxcGYN139lnk30rDEYqMp85XFBoHbEknmEB:dqgazxc5H39ln2HYuFFslmEB
TLSH: T1DA5C12661F3F3613EA25C6A4F212FE9E84B7D525C33BFC4CA0EA741D82D448B6620549
Submitted as: 5a301bef3f6013e2e6c4353ab19447234f0ec196e5c292393f53c3dcb203d192
File type: pe · Size: 2539954 bytes
Verdict: malicious (100/100) · Family: Ulise

Detections (8 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
ClamAV (daily): Win.Malware.Ulise-9786791-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_VMProtect
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Ymacco.AB5A
Emsisoft (Emergency Kit): Gen:Variant.Genie.59
Kaspersky (KVRT): HEUR:Trojan.Win32.Kryptik.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Ulise-9786791-0 (rule Win.Malware.Ulise-9786791-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Ymacco.AB5A (rule Trojan:Win32/Ymacco.AB5A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Genie.59 (rule Gen:Variant.Genie.59) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Kryptik.gen (rule HEUR:Trojan.Win32.Kryptik.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_Packer_VMProtect (rule YR_Packer_VMProtect) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Themida/VMProtect (rule Themida/VMProtect) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Themida/VMProtect, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

93 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
login.live.com
desktop-hsgcbep
v20.events.data.microsoft.com
config.edge.skype.com
windows.msn.com
www.msn.com
officeclient.microsoft.com
odc.officeapps.live.com
licensing.mp.microsoft.com
assets.msn.com
www.bing.com
th.bing.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
www.msftconnecttest.com/connecttest.txt

Dropped files

C:\Program Files (x86)\wvs\fpgu.exe - 1bb5f96e2d03641de6a2aabbf117438bb0aaef0b08685c5026e1964fa5914106

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

4.150.223.102
20.247.184.142
4.230.171.124
104.18.33.89
52.110.12.19
52.110.12.30

File paths

C:\=hC
R:\h8k

More Ulise samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report