MALICIOUS — 03119973179a504c27620333397a980f662cc99f8a66e31faea0d846039ed3e2

MALICIOUS — 03119973179a504c27620333397a980f662cc99f8a66e31faea0d846039ed3e2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the HUILoader family. 6 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 03119973179a504c27620333397a980f662cc99f8a66e31faea0d846039ed3e2
SHA-1: 1e8432affbf2cafcfa06274f4ac523cb81099a87
MD5: c51086dd25a57b25508ad8a71e967578
imphash: 45f8a9e8d4cd3479ddbb67ddc832e68f
ssdeep: 24576:WBis7vHbTP4mXwvrn2WwoNLnH2IFqmt8lIfJoTCgwDryYK1Qw6LWP69E3J:+vnP0n2ynRelIfJoTIiYKiG
TLSH: T11A56E100E31E2EB0CDB8F4B55ED5D82D6C437A6A973B9EC8514FDBAF4054DA3A058029
Submitted as: 03119973179a504c27620333397a980f662cc99f8a66e31faea0d846039ed3e2
File type: pe · Size: 1388504 bytes
Verdict: malicious (93/100) · Family: HUILoader

Detections (6 of 55 engines)

capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text,.sedata,.sedata
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
Detect It Easy (packer/type): DIE:Microsoft Linker
Kaspersky (KVRT): UDS:Exploit.Win32.CVE-2014-4113

MITRE ATT&CK

T1056.001

Why this verdict

The malicious score of 93/100 is the fusion of 9 weighted signals:

Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 18 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.altanbasim.com/editor/assets/ims.cer - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text,.sedata,.sedata, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

99 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

0f5e35b4976dc18e6e4482d9acff50c677ed51b22ce6fd35e5a8ffe383f97c57 - 0f5e35b4976dc18e6e4482d9acff50c677ed51b22ce6fd35e5a8ffe383f97c57

Embedded URLs

http://www.altanbasim.com/editor/assets/ims.cer
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

altanbasim.com
www.shagzzz.cjb.net
www.altanbasim.com
shagzzz.cjb.net

Embedded IP addresses

4.150.223.112
4.230.171.124
4.144.132.223
85.210.193.152
85.210.196.11
74.179.77.204
74.179.77.164
52.168.117.169
52.123.128.14
20.76.201.171
52.123.129.14
172.178.240.162
135.232.92.34
52.110.12.25
52.148.114.188
72.153.5.133
52.110.12.22
52.110.12.1

File paths

o:\770
z:\Z
C:\Inetpub\vhosts\altanbasim.com\httpdocs\editor\assets
C:\Inetpub\vhosts\altanbasim.com\httpdocs\editor\assets\

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report