MALICIOUS — 15422022da62b92aef659b7d3b21b128160767dc0882baf7c30ac0885f916b20
MALICIOUS — 15422022da62b92aef659b7d3b21b128160767dc0882baf7c30ac0885f916b20 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 7 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
15422022da62b92aef659b7d3b21b128160767dc0882baf7c30ac0885f916b20 - SHA-1:
88c8c0fe6b4a96928a3688bfa27d3b58fadcfdc4 - MD5:
6cdc625de5bdb1e47b14e7871f510ef9 - imphash:
b10d16eedb1085ef7262dfc4ab03be6f - ssdeep:
12288:KgPEFMFneWix1c60y1gPEFMFneWix1c60yHgPEFMFneWix1c60y:nPEFMFnrPEFMFnlPEFMFn - TLSH:
T1AC4A5B5B5257E81EC27697373AD0C74E6C82E44C81BA947543CFE22F887A52B3B74062 - Submitted as: 15422022da62b92aef659b7d3b21b128160767dc0882baf7c30ac0885f916b20
- File type: pe · Size: 438526 bytes
- Verdict: malicious (100/100) · Family: HUILoader
Detections (7 of 56 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Genpack-9875154-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Detect It Easy (packer/type): DIE:UPX
- Microsoft Defender: Virus:Win32/Sivis.A
- Emsisoft (Emergency Kit): Win32.Sivis.A
- Kaspersky (KVRT): Virus.Win32.Agent.es
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 13 weighted signals:
- ClamAV (daily) flagged Win.Malware.Genpack-9875154-0 (rule
Win.Malware.Genpack-9875154-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Virus:Win32/Sivis.A (rule
Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule
Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Virus.Win32.Agent.es (rule
Virus.Win32.Agent.es) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Contacted 1 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
- Detect It Easy (packer/type) flagged DIE:UPX (rule
DIE:UPX) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule
UPX) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, http://www.gnu.org/licenses/, https://d.symcb.com/rpa0 - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
- Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Extracted generic config (4 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
18998 behavior events · 0 ATT&CK techniques · 98 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- windows.msn.com
- www.msn.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
- licensing.mp.microsoft.com
- www.bing.com
- th.bing.com
- tas02.sls.update.microsoft.com
Dropped files
- C:\Program Files\7-Zip\Lang\hi.txt -
e470d3932cb305ba9d2599b560e1eedda58ef9676fce59563a7272a142168430 - C:\Program Files\7-Zip\Lang\be.txt -
f12ff502fab267e5d3bfdc783178fb7c6941c84103337da0b34efb775fc4ffb7 - C:\Program Files\7-Zip\Lang\es.txt -
c286ea8a5a0ca802c5c10c5d1064c968e649fae097cf150ee40d3afbc3c36359 - C:\Program Files\7-Zip\Lang\de.txt -
0c9ecad43acc78a733ab09bf660edacb0595b8e2b658cc0b4747765a5c4dd5c8 - C:\Program Files\7-Zip\Lang\ext.txt -
5889654077df7f79bbff51a5297930cb522820807728af6356fc3d2b82b1a437 - C:\Program Files\7-Zip\7-zip.chm -
7f9b91e639c94d7cb0a20ef1aaed99a646953ba67dadccd94ce7cb678ad6c5c9 - C:\Program Files\7-Zip\Lang\is.txt -
bc0ac42dc5da58873de64e32965f5879cd4da2f7ea6d084d98baf0e77bb8495d - C:\Program Files\7-Zip\Lang\he.txt -
3a0137384b85604ff70d907f64ef02e366605dcee2c6b9819908576c7a68575b - C:\Program Files\7-Zip\Lang\ko.txt -
f459350a088d79fe639aabab0ea0f3acee84c14c0fe5e4458359859f104ad5a0 - C:\office-config.ps1 -
bc5534f6c8d402edc6db71dda5c31d4a4ec89997c7d999a1fb5ab4efb0acfcbf - dcb370a7ad2d668e6964520d03521a659e784818741ebad54e673f89cb8f207c -
dcb370a7ad2d668e6964520d03521a659e784818741ebad54e673f89cb8f207c - C:\Program Files\7-Zip\Lang\br.txt -
3947e46e3b3171be3b5aaf0d17c110239673d1dceec28aa22c7e0874105eebf4 - C:\Program Files\7-Zip\Lang\co.txt -
60143c695ec2a6af13155d47ab7c91a770bb3ab20111680011934a920c6cf66f - C:\Program Files\7-Zip\Lang\ms.txt -
e47d9d773d8895a085e5d7e645ae9a34db83f1392503f859cb4d040b4155a028 - C:\$WinREAgent\Backup\boot.sdi -
6e1e727103c5078695bfbf949ebae4469cf67672c5771be56e18b70349f2b4a7
Embedded URLs
- http://creativecommons.org/publicdomain/zero/1.0/
- http://www.gnu.org/licenses/
- https://www.digicert.com/CPS0
- http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
- http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
- http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
- http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
- http://www.digicert.com/ssl-cps-repository.htm0
- https://d.symcb.com/rpa0
- http://s.symcb.com/universal-root.crl0
- https://d.symcb.com/rpa0@
- http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
- http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
- https://www.gnu.org/software/automake/manual/automake.html
- http://fsmsh.com/2753
- https://autotools.io/index.html
- http://miller.emu.id.au/pmiller/books/rmch/
- http://www.digicert.com/CPS0
- http://crl3.digicert.com/sha2-assured-ts.crl02
- http://crl4.digicert.com/sha2-assured-ts.crl0
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- creativecommons.org
- geocities.com
- cwru.edu
- gnu.org
- www.gnu.org
- crl3.digicert.com
- crl4.digicert.com
- www.digicert.com
- cacerts.digicert.com
- d.symcb.com
- s.symcb.com
- ts-crl.ws.symantec.com
- ts-aia.ws.symantec.com
- fsmsh.com
- autotools.io
- miller.emu.id.au
- ardownload.adobe.com
- www.adobe.com
Embedded IP addresses
- 104.46.162.231
- 4.230.171.124
- 20.247.184.197
- 85.210.193.152
- 4.247.188.224
- 74.179.77.204
- 135.232.92.97
- 20.184.175.8
- 172.64.154.167
- 20.42.73.24
- 135.233.45.221
- 92.223.78.30
- 52.110.12.2
- 52.110.12.25
- 192.42.116.116
More HUILoader samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report