MALICIOUS — UT2004 + codes.exe

MALICIOUS — UT2004 + codes.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 19b3f6ece64aaf6de286f2343037a38fc1bd5f457804145bacacf9d3e51c9631
SHA-1: 43145d156074c6f3d69032cc7a5b92f49d4a6bf3
MD5: abf97218f9f910b5c32669c026792c86
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 12288:5wawSwaw1wawSwaw9zJwawSwaw1wawSwaw9zswawSwaw1wawSwaw9zJwawSwaw1A:I
TLSH: T1F860D100327A399CD7709F605524598DA22552C1897D3EEA9B03072D3CB78BBB9E8F71
Submitted as: UT2004 + codes.exe
File type: pe · Size: 3523525 bytes
Verdict: malicious (97/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 97/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
Contacted 34 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 6 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

120 behavior events · 0 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Windows\win32dc\FlatOut_trainer.exe - d9d0e319335a47f5ee9fb732ebd8b6caaeb26f23ef025cf0bbce9ff3ff115422
C:\Windows\win32dc\DAoC(cdfix).exe - 884bdf810556a2c769b69833f4fa7c155483064b6057481fdb25c1d3a375703f
C:\Windows\win32dc\FlatOut cdfix.exe - f67a5161d9597f1bd6df30a307bf1899a3904978ba1ec7ebc5327754bedab6c4
C:\Windows\win32dc\UT2004 cheat.exe - 3a93ed2e2d27b64359dd744d88cdc7ee1b81ed9cbaed4bde1acead5a6d13949c
C:\Windows\win32dc\Half-Life 2 + cdfix.exe - d4329a581040c8f87085a0d292a7d4b55c2641f434e15be47cb68f5da85b4bce
C:\Windows\win32dc\Half-Life 2 + crack.exe - 618e91b075a4b9db7879060b447e516679f40314205067c9714b06f17a93046a

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787654281&P2=404&P3=2&P4=dQB%2buVGJ7430AkaaZc9MAm2TzPSWtfT1ebEwYmOQSe92PqLg2qnn9FbvPV%2fDDicqPIqDLMJA2AkY4vqXsEWThg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

52.123.252.238
4.150.223.100
57.154.63.210
52.110.12.37
74.179.77.204
4.247.188.224
52.123.129.14
162.159.142.9
20.236.44.162
74.178.76.44
4.150.223.112
172.178.240.162
52.123.252.227
135.232.92.97
52.123.252.223
92.223.78.30
172.66.2.5
20.231.239.246
4.230.171.124
4.247.188.233
4.144.132.114
172.215.188.225
52.123.252.231
72.153.5.129
20.184.175.6

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report