MALICIOUS — 0eca076560ab7af10559e39df6cb6c552287bc389740ebb8d746fbfea4d14ac5

MALICIOUS — 0eca076560ab7af10559e39df6cb6c552287bc389740ebb8d746fbfea4d14ac5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the HUILoader family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 0eca076560ab7af10559e39df6cb6c552287bc389740ebb8d746fbfea4d14ac5
SHA-1: 763174354180803e9a8b7bfee3c6cc023740640a
MD5: 25b533157fd887a9507df1d19abb07a2
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 12288:Cw43sQVtXp6QaQl/4ZHUZ4AoNviffcmIZJhYNqYXC7g5sWvmw5iXB0OZPK9:9+ZXl/WzAoRifEhcrS7g5sWrZOE
TLSH: T1D65EB39DCEA33B44C3E52639E81F461CE53C1C1660D8B8678EDB41E796EE22B052D14B
Submitted as: 0eca076560ab7af10559e39df6cb6c552287bc389740ebb8d746fbfea4d14ac5
File type: pe · Size: 2875392 bytes
Verdict: malicious (98/100) · Family: HUILoader

Detections (4 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Generic-9907165-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9907165-0 (rule Win.Trojan.Generic-9907165-0) - engine signal, weight 0.90, confidence 0.95
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.eyuyan.com - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

48 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com/0
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.eyuyan.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com
www.eyuyan.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.73.25
48.211.4.16
52.123.252.203
20.247.184.142
4.230.171.124
57.154.63.210
74.179.77.204
135.232.92.97
13.69.116.105
52.168.117.168
172.64.154.167
20.42.73.30
51.116.253.170
52.110.12.47
52.110.12.45
72.154.7.109
52.148.114.188
52.110.12.44

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report