MALICIOUS — 27bb83d1f0c1adcbbfbfbb240ae9e10c6ab115a7f435ab079445a682d1693745

MALICIOUS — 27bb83d1f0c1adcbbfbfbb240ae9e10c6ab115a7f435ab079445a682d1693745 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 7 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 27bb83d1f0c1adcbbfbfbb240ae9e10c6ab115a7f435ab079445a682d1693745
SHA-1: 05d07568f3193663394ed0550c658e8bae910e78
MD5: 0ac163aa80ed723c846079d84287f497
imphash: faea664dccb12d653cbea3ef51eb7d97
ssdeep: 6144:jVTarW9Q2d/6VPAKovnQUvmmAF7J77777S40X2:jVmrW9HKPGvnQUvmmAF7J77777SnX2
TLSH: T1C548CFCA7203A75DFA270BAB84624E2D9091D0FC94B11A04A8DFCD9D5B71CD394C7AE1
Submitted as: 27bb83d1f0c1adcbbfbfbb240ae9e10c6ab115a7f435ab079445a682d1693745
File type: pe · Size: 377110 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:xywvfys
ClamAV (daily): Win.Trojan.BankerSpy-1
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Trojan.GenericKDZ.114310
Trellix Stinger (McAfee): W32/Autorun.worm.aacd
Kaspersky (KVRT): Worm.Win32.Juched.fhz

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Trojan.BankerSpy-1 (rule Win.Trojan.BankerSpy-1) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.114310 (rule Trojan.GenericKDZ.114310) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/Autorun.worm.aacd (rule W32/Autorun.worm.aacd) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.Juched.fhz (rule Worm.Win32.Juched.fhz) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:xywvfys (rule high-entropy-sections:xywvfys) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:xywvfys - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

48142 behavior events · 3 ATT&CK techniques · 4 dropped files.

Dropped files

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\d42cc0c3858a58db2db37658219e6400_14e6c4d9-c2fb-4c56-9a8f-a9746d9742af - b54d0a5c26f36712dcb7fe051cbaf9ba0493fd1f0faf503ac9b814caabdf3998
C:\Windows\Tasks\Update23.job - 7326802d79839bf8c11410e15c1409eb119b2e2c921a15d46a4746ae5df6b423
C:\Program Files (x86)\800e9cf7\800e9cf7 - 57ef9e3c809cf3ca41782d4c7119c3ae7e43ccbb1c00d978b745677f14b82c2e
C:\Program Files (x86)\800e9cf7\jusched.exe - 9efd9ca6a2a301413aa518e56faa9e6710812b42ee4e76473fd20199eb34d7fe

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

ftp.byethost12.com
griptoloji.host-ed.net
ftp.tripod.com

Embedded IP addresses

216.218.185.162
20.42.73.31
4.230.171.124
4.144.132.114
104.18.33.89
85.210.196.11
162.159.142.9
20.184.175.9
135.233.45.222
172.178.240.161
185.27.134.11
20.42.179.204
72.145.35.109
52.148.114.188
52.110.12.52
52.110.12.48

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report