MALICIOUS — 92a07159873a6b93851c11503e671f4044db02247b8a1e5997da18cbbb9fc733

MALICIOUS — 92a07159873a6b93851c11503e671f4044db02247b8a1e5997da18cbbb9fc733 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Multiverze family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 92a07159873a6b93851c11503e671f4044db02247b8a1e5997da18cbbb9fc733
SHA-1: 576bbc6dd7fb9531d0674f276ed33423b3726831
MD5: c69dddea6d36a3fd05d4b733b7b8e05f
imphash: 0d52988c17b6d0ad679318ef76f1e151
ssdeep: 1536:BL+O/U7OBmKGS6CBK0t/ZCXPGuxgDM5YKBGNc/xf6KWcs8+SUkIcekqY1o/uImzi:BLxUyjp3xCTyDMsUWyw+Ubx7NZ
TLSH: T12C3D5BD29D037521E07ADA886C1476FC84A2F8AD3935814D635BC90E10F797BB93236E
Submitted as: 92a07159873a6b93851c11503e671f4044db02247b8a1e5997da18cbbb9fc733
File type: pe · Size: 134154 bytes
Verdict: malicious (99/100) · Family: Multiverze

Detections (5 of 56 engines)

ClamAV (daily): Win.Malware.Ulise-9886066-0
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
Microsoft Defender: Trojan:Win32/Multiverze!pz
Emsisoft (Emergency Kit): Generic.Dacic.1660.B70A67F1
Kaspersky (KVRT): HEUR:Trojan.Win64.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Ulise-9886066-0 (rule Win.Malware.Ulise-9886066-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Multiverze!pz (rule Trojan:Win32/Multiverze!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Generic.Dacic.1660.B70A67F1 (rule Generic.Dacic.1660.B70A67F1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win64.Agent.gen (rule HEUR:Trojan.Win64.Agent.gen) - engine signal, weight 0.55, confidence 0.85
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70
Contacted 8 external host(s) and 13 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://pm2pavba27wr4m34.onion/command.txt?smbdff - static signal, weight 0.35, confidence 0.60
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in tsk_9e4de68b41 (pid 8808) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

59 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://pm2pavba27wr4m34.onion/command.txt?smbdff
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://171.25.193.9:443/tor/status-vote/current/consensus
http://216.218.219.41/tor/server/fp/7e47d28f07443b57f8262e1412936b3e258694a3
http://204.13.164.118/tor/server/fp/75853c2aa60eaf038a070158341cbdb3adc717cb
http://216.218.219.41/tor/server/fp/916dc3199f639168cd20aec4d45969268e807699
http://216.218.219.41/tor/server/fp/9173eeb6ed71b478eca8378b7883b6c6302e6083

Embedded domains

pm2pavba27wr4m34.onion

Embedded IP addresses

104.46.162.224
20.247.185.124
52.123.252.215
4.230.171.124
104.18.33.89
199.254.238.52
82.94.251.203
52.110.12.46
52.110.12.54
172.215.188.225
171.25.193.9
216.218.219.41
204.13.164.118
72.145.35.105
152.53.15.144
52.148.114.188
52.110.12.15
52.110.12.3

More Multiverze samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report