MALICIOUS — a81f46d757f5c033802b370d8c20b79754c0157e9d37598d6730f7e9a1cda0bc

MALICIOUS — a81f46d757f5c033802b370d8c20b79754c0157e9d37598d6730f7e9a1cda0bc is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Ulise family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: a81f46d757f5c033802b370d8c20b79754c0157e9d37598d6730f7e9a1cda0bc
SHA-1: 84af331a4a52e9e3bf9230eed0b52fac5c1f8a63
MD5: 1f9f463792f51586dd70f0dd18a95d7e
imphash: 683b1105f11477b15337eac0e16f858e
ssdeep: 768:eMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:ebIvYvZEyFKF6N4yS+AQmZTl/5
TLSH: T13F379DCE9119C70ECB38DEA1AC04EE9E10BBB85AD0F5B26C2EDAC13E01F0457D855659
Submitted as: a81f46d757f5c033802b370d8c20b79754c0157e9d37598d6730f7e9a1cda0bc
File type: pe · Size: 70128 bytes
Verdict: malicious (100/100) · Family: Ulise

Detections (6 of 56 engines)

ClamAV (daily): Win.Malware.Ulise-7170100-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
Microsoft Defender: Trojan:Win32/ButeRat!pz
Trellix Stinger (McAfee): Dropper-FZK!1F9F463792F5
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Ulise-7170100-0 (rule Win.Malware.Ulise-7170100-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/ButeRat!pz (rule Trojan:Win32/ButeRat!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Dropper-FZK!1F9F463792F5 (rule Dropper-FZK!1F9F463792F5) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 external host(s) and 25 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.45, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://ow5dirasuek.com/, http://mkkuei4kdsz.com/, http://lousta.net/ - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

867 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Windows\System32\omsecor.exe - 3a5e23df9cac6cab0cad1fa8c385675b81627492a2a2992c97c42d0d6551e011
C:\Users\analyst\AppData\Roaming\omsecor.exe - 8b1508d675ea0cfff2dde7b20e37ff102e54607ec638d8ce37f20db14cad4fb1

Embedded URLs

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://lousta.net/907/936.html
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://mkkuei4kdsz.com/285/994.html
http://ow5dirasuek.com/131/210.html

Embedded domains

begun.ru
an.yandex.ru
ow5dirasuek.com
mkkuei4kdsz.com
lousta.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.73.28
4.230.171.124
4.247.188.233
20.247.184.142
74.178.240.61
135.233.95.135
20.42.65.85
57.154.63.210
52.182.143.212
52.110.12.37
193.166.255.171
52.110.12.52
104.18.33.89
4.150.223.99
4.150.223.114
172.215.188.225
3.238.30.69
44.192.95.127
52.148.114.188
72.153.5.140
52.110.12.42
52.110.12.48

File paths

C:\WINDOWS\system32\gbdwpbm.dll

More Ulise samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report