MALICIOUS — 0e61e8e6d4118a5b4a3a11fdf887fd2f504be8468c56dd5601c5d41fb5e845eb

MALICIOUS — 0e61e8e6d4118a5b4a3a11fdf887fd2f504be8468c56dd5601c5d41fb5e845eb is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 8 of 56 detection engines flagged it, exhibiting 14 ATT&CK techniques.

Identification

SHA-256: 0e61e8e6d4118a5b4a3a11fdf887fd2f504be8468c56dd5601c5d41fb5e845eb
SHA-1: a30f78cd71ff8e5b2654d43d578a7bbe0fcc2790
MD5: 67ec51f0b4a8ac77732c1b508226814b
imphash: 332eb0b5fe810328a790cefab69caee5
ssdeep: 12288:VbKHXF+GJE3beZZzs72E7jrVmPhW8Up128GBjQrqTSt/kEzZJZ8bgnh2iGTymyt:dKHXF+GJWgFAcTSt/kEzZKghJG+vY
TLSH: T144578DBC37CABE6CDF154408A943953FF42B89A091D198680F91F8E85089CE7DA81F5D
Submitted as: 0e61e8e6d4118a5b4a3a11fdf887fd2f504be8468c56dd5601c5d41fb5e845eb
File type: pe · Size: 1510912 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (8 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
capa (capabilities): capability:collection/keylog
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/Wacatac.B!ml
Emsisoft (Emergency Kit): Trojan.Generic.38750620
Kaspersky (KVRT): Rootkit.Win64.Agent.bhc

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 21 weighted signals:

5 behavioral detection(s) across 5 rule(s): Service Installed and Removed in the Same Run [high] (rule tl-service-install-delete) - dynamic signal, weight 0.72, confidence 0.90
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Wacatac.B!ml (rule Trojan:Win32/Wacatac.B!ml) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Generic.38750620 (rule Trojan.Generic.38750620) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Rootkit.Win64.Agent.bhc (rule Rootkit.Win64.Agent.bhc) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://curl.se/docs/http-cookies.html, https://curl.se/docs/alt-svc.html, https://curl.se/docs/hsts.html - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

10547 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Windows\Nova.Service.sys - e0d319c43a12f927d0630056aeef89d654d550bd1f2a9d096c30565f72fcefa8
C:\Program Files (x86)\Nova\Nova.Helper.exe - 77d3d15a9de2fec2d469835bbdea5d51ee330fd545d62c601b15a0ebba357186
C:\ProgramData\Nova.Config.ini - 6bd9773ef40b6e85198fbdaf772962bf29c655191cb99e3f8284516fc116f52f

Embedded URLs

https://curl.se/docs/http-cookies.html
https://curl.se/docs/alt-svc.html
https://curl.se/docs/hsts.html
https://www.verisign.com/rpa
https://www.verisign.com/rpa0
https://www.verisign.com/cps0*
http://logo.verisign.com/vslogo.gif0
http://crl.verisign.com/pca3.crl0
https://sockethax.com/nova/check_loader.php?action=GET_LOADER_DATA
https://cdn.discordapp.com/attachments/742968143101821019/908634448176762900/Nova.Font.ttf
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

curl.se
example.com
www.verisign.com
csc3-2009-2-crl.verisign.com
csc3-2009-2-aia.verisign.com
logo.verisign.com
crl.verisign.com
crl.microsoft.com
sockethax.com
cdn.discordapp.com

Embedded IP addresses

1.101.3.4
52.168.117.170
20.247.184.142
52.123.252.231
4.230.171.124
172.66.2.5
52.110.12.22
52.110.12.20
135.233.45.223
57.154.63.210
72.145.35.101
52.148.114.188
52.110.12.47

File paths

C:\Users\Administrator\Desktop\CallBack\x64\Release\CallBack.pdb
C:\root_folder\projects\pubg_mobile\current_projects\Nova\Nova.Loader\Release\Nova.Loader.pdb
X:\:`:d:h:l:p:t:x:
T:\:d:l:t:

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report