MALICIOUS — DAoC_hack.exe

MALICIOUS — DAoC_hack.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 2734b9557f09801df808d6667deead197a189bc1be6940a608c11fce3849dc96
SHA-1: 765622f635567cadf8e0dd35f3678c3b471a512e
MD5: 6c8c471aa07ceedf0884deb0d13e3164
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 12288:5wawSwaw1wawSwaw9zJwawSwaw1wawSwaw9zswawSwaw1wawSwaw9zJwawSwaw1D:7
TLSH: T19860D100327A399CD7709F605524598DA22552C1897D3EEA9B03072D3CB78BBB9E8F71
Submitted as: DAoC_hack.exe
File type: pe · Size: 3528645 bytes
Verdict: malicious (98/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
Contacted 28 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 8 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

284 behavior events · 0 ATT&CK techniques · 8 dropped files.

Dropped files

C:\Windows\win32dc\Half-Life 2(serial).exe - f041e8303885ba5bcb7ddd7a51aa8cd30fa14b3183a1a9808ca8ce613bcdb8f5
C:\Windows\win32dc\Sims 2(serial).exe - 3201b7c967e84798b854520c85b991103df32155757f66f4875420ace2d09388
C:\Windows\win32dc\Quake3 + cdfix.exe - 6468482ab84187ae5803542b34e4c38f6620a80b1878f5b944aa75c4302f2515
C:\Windows\win32dc\Half-Life 2_hack.exe - bc6ba9f2f9b1b41362adfb03c415641ea77af756af07a4da895a54de57ed8a44
C:\Windows\win32dc\Sims 2 + fix.exe - cb88e2817e637ae61a68af4efc813102128279c14640095f6f2c1b9ddda18be6
C:\Windows\win32dc\Quake3_fix.exe - 161b2b310b7a4fbee680d9c889fef504327536394b03f27aa5143f6a659e1bfd
C:\Windows\win32dc\UT2004(hack).exe - c8a1b85e96f037b58513879d01e75745d44524e26f23b2486c0b40158f8cd93b
C:\Windows\win32dc\UT2004_nocd.exe - c2c17cda2dc4c797ef79f8fbd728f46dd3b2b67795ec02d189ed601803d1f487

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787644786&P2=404&P3=2&P4=imMwcrdvgHsRpvr8UlJgPIGZPzQU0%2baAQzWuJcDWcOuk1B%2ba8uo8rT88ylxFZjKQEkb41y4hAtZY9Ph2jr3eeQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787644841&P2=404&P3=2&P4=ZJ1DjHLjPqOgS7NtLedXZkYAMQdoKla%2fNUc0PRdc0YEKLXi52Lee1TBK9oOUvvkp%2fAW1sbWFFr2888%2bnDqFmBw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

40.79.141.155
4.230.171.124
85.210.193.152
4.144.132.114
40.84.97.4
74.178.76.128
51.116.253.169
135.232.92.97
20.231.239.246
40.103.64.226
172.66.2.5
40.99.134.2
52.123.128.14
52.123.129.14
203.26.79.13
20.165.94.46
52.110.12.5
52.110.12.49
135.233.45.221
52.148.114.188
20.42.65.85
72.153.5.129
20.42.179.204
20.42.65.88
13.89.179.12

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report