MALICIOUS — DriftBootstrapper.exe
MALICIOUS — DriftBootstrapper.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (82/100), attributed to the HUILoader family. 3 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
26815c74e33e33337dbaee321576f0fd94b746e76d8a8f44c0116879c1d71832 - SHA-1:
0edddd18929018c1c6fda4e56b4d9c2dc491ee36 - MD5:
024a341cdcae4c77dbb1697fde22d073 - imphash:
bb3ac2c21e02c68abcad237dc3fa6d00 - ssdeep:
12288:EvggNaxmfzObbVf7W+YEtJ02r4HRyq/2VtK53XHYZDkKyzObbVf7W+YEtJ/J4dCu:T4AoOJ4dCXzRKX4EcJAD1RrQ4 - TLSH:
T1CF573ACF0A3D1311C5BAD428A91587EDA906B0DC3576BACD1A0ACA720097733FD7646E - Submitted as: DriftBootstrapper.exe
- File type: pe · Size: 1548538 bytes
- Verdict: malicious (82/100) · Family: HUILoader
Detections (3 of 55 engines)
- capa (capabilities): capability:execution/powershell
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Yara-Rules community: YR_AntiDebug_Checks
MITRE ATT&CK
Why this verdict
The malicious score of 82/100 is the fusion of 5 weighted signals:
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - execute via PowerShell (rule
execute via PowerShell) - capa signal, weight 0.40, confidence 0.80 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - capa (capabilities) flagged capability:execution/powershell (rule
capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://discord.gg/realzorara, https://drift-ads.kfcclient.com/ad.html, https://www.kfcclient.com/api/endpoint/driftext.json - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://www.microsoft.com
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
- http://schemas.microsoft.com/winfx/2006/xaml
- http://schemas.syncfusion.com/wpf
- https://go.microsoft.com/fwlink/?linkid=798306
- https://aka.ms/dotnet-core-applaunch
- https://aka.ms/dotnet/app-launch-failed
- https://discord.gg/realzorara
- https://drift-ads.kfcclient.com/ad.html
- https://www.kfcclient.com/api/endpoint/driftext.json
- https://gitlab.com/rackjhon81/drift/-/raw/main/archives/Drift.zip?inline=false
- https://www.kfcclient.com/terms
- https://learn.microsoft.com/microsoft-edge/webview2/concepts/versioning
Embedded domains
- www.microsoft.com
- crl.microsoft.com
- schemas.microsoft.com
- schemas.syncfusion.com
- go.microsoft.com
- discord.gg
- drift-ads.kfcclient.com
- www.kfcclient.com
- gitlab.com
- learn.microsoft.com
- aka.ms
Embedded IP addresses
- 10.0.9.0
- 5.6.7.98
File paths
- D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
- D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb
- D:\a\_work\1\s\third_party\edge_webview2\win\winforms_control\Microsoft.Web.WebView2.WinForms\obj\Release
- D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\Release
- C:\Drift.
More HUILoader samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report