MALICIOUS — 124f21d1c9d6e6bd416056febd0260c35d14875ff99096056730aa1f06dbddf1

MALICIOUS — 124f21d1c9d6e6bd416056febd0260c35d14875ff99096056730aa1f06dbddf1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upantix family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 124f21d1c9d6e6bd416056febd0260c35d14875ff99096056730aa1f06dbddf1
SHA-1: 1db0c0d14e5bb56d62a7a72d375ba44aab898684
MD5: c0bcf81c8bc19efffbeb35e07b473fdf
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 12288:5wawSwaw1wawSwaw9zJwawSwaw1wawSwaw9zswawSwaw1wawSwaw9zJwawSwaw1y:52R
TLSH: T1DF67D100327A399CD7709F605524598DA22552C1897D3EEA9B03072D3CB78BBB9E8F71
Submitted as: 124f21d1c9d6e6bd416056febd0260c35d14875ff99096056730aa1f06dbddf1
File type: pe · Size: 7040350 bytes
Verdict: malicious (99/100) · Family: Upantix

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Upantix.GM!MTB (rule Trojan:Win32/Upantix.GM!MTB) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Packed.Win32.Upantix.gen (rule HEUR:Packed.Win32.Upantix.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 8 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

221 behavior events · 0 ATT&CK techniques · 8 dropped files.

Dropped files

C:\Windows\win32dc\Sims 2_patch.exe - 0f2908b7cb04bbfe015b32a0bd72755746e36ed859abcdd76d07712ed6087f73
C:\Windows\win32dc\BattleField 1942 nocd.exe - 866696d80db8ac52b70c85f239a638bc89898ed2121a3cba087f57bb9984622f
C:\Windows\win32dc\Counter-Strike + crack.exe - 90a7e24d4618c248dc93e8d1a17b6e6aef0bf211fbf0228eb5b93003f6d2a956
C:\Windows\win32dc\Quake3 + trainer.exe - 50c1699e83acaece6f62b6c4218bbcb3fe51287791b8fa69e781fdf3102a3a80
C:\Windows\win32dc\FlatOut(cdfix).exe - 3c4dc2e681f3d56add58c022dad6e008a7c9859efc57b3ab358420b99addf017
C:\Windows\win32dc\UT2004_hack.exe - 7a35d49facc7102434ef235dcc5ffaa26e587f3deaba1d799e9f0712aa36842c
C:\Windows\win32dc\Half-Life 2 + patch.exe - c6edab89bd6dd402d0d97e472e0dd9bea105666314df99da4718be770613878e
C:\Windows\win32dc\BattleField 1942 cdfix.exe - f99cf525f8c3e10aa8c427b7dbecd270bf693bfa07f6d60cb2d38a7ba57b9855

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.112.66
135.232.92.97
57.155.101.212
135.232.92.137
51.116.246.105
104.18.33.89
4.230.171.124
20.42.179.192
20.247.185.124
72.145.35.100
52.148.114.188
52.110.12.53
52.110.12.56

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report