MALICIOUS — 2ac3384c7d95f9a282853ac3fd513b467d8469c842f5e482c0d47fb07ee77a3e

MALICIOUS — 2ac3384c7d95f9a282853ac3fd513b467d8469c842f5e482c0d47fb07ee77a3e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the HUILoader family. 3 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 2ac3384c7d95f9a282853ac3fd513b467d8469c842f5e482c0d47fb07ee77a3e
SHA-1: e3017029070f8e6f63ff11d6016ed00c0460f6ce
MD5: 2b123c58701f17115d871b87b8602cd2
imphash: c9adc83b45e363b21cd6b11b5da0501f
ssdeep: 12288:pANwRo+mv8QD4+0V160q8vKmTzCb+qNrTwBzPvq/utEarxhHxKQdRgyfnONIMYcP:pAT8QE+kj9TzA+qmfHU6gxNhr7gMR
TLSH: T1685112B2636A7713DAB6D32518805F2E046378BA60BE3DDD4103A01D77FCC6B5DA0199
Submitted as: 2ac3384c7d95f9a282853ac3fd513b467d8469c842f5e482c0d47fb07ee77a3e
File type: pe · Size: 883630 bytes
Verdict: malicious (99/100) · Family: HUILoader

Detections (3 of 56 engines)

capa (capabilities): capability:collection/keylog
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Kaspersky (KVRT): HEUR:Trojan-Spy.MSIL.Stealer.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 14 weighted signals:

1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Kaspersky (KVRT) flagged HEUR:Trojan-Spy.MSIL.Stealer.gen (rule HEUR:Trojan-Spy.MSIL.Stealer.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 1 external host(s) and 13 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://jetcleanerpro.com - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

28099 behavior events · 3 ATT&CK techniques · 16 dropped files.

Dropped files

C:\Program Files (x86)\JetCloud\JetCleaner\Updater.exe - 5fad17d686f12bbf3944c2a4b4b28e5e30589346f16c14a5a13400c3c6152d3b
C:\Program Files (x86)\JetCloud\JetCleaner\adj.reg - f56c3bb0712536558ba9e97704c9496033542f4d144877a8e193b072154ab4d4
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db - 7f4e824fc48443e0eba51bc4f486297952ee474067140ad9cb51ef51d4742e6d
C:\Program Files (x86)\JetCloud\JetCleaner\Uninstall.ini - e2533e00cbc2b6fe6c6eea6e53c5d41b16934a95c9da863a33fe1939a88bf01d
C:\Program Files (x86)\JetCloud\JetCleaner\Uninstall.exe - 3b064acc2798d76ae1e08002a91a8deba4d038641dfafbcdd25102d3f0cf68d8
C:\Users\analyst\AppData\Local\Temp\$inst\2.tmp - a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f
C:\Program Files (x86)\JetCloud\JetCleaner\adj2.reg - 2db641fc285a8ed0236bed9d6d42ccaf669ee46bd2b67f037de847410d8e2c0e
C:\Program Files (x86)\JetCloud\JetCleaner\JetCleaner.exe - a7d2d6805fe8eff332f3c04d06fac416b18304103eb1e9b34825c1e662985605
C:\Users\analyst\AppData\Local\Temp\$inst\temp_0.tmp - 649e2567be967b722ce25c82c06f37bdac821903914fdb73cce78feb7c3ac366
C:\Program Files (x86)\JetCloud\JetCleaner\log.bat - 4bbdb72fd4e95e6e6e58b64f23bca2aab60cc62d05847daee58277a72f7547c1
8a9491658f3a370009323644b6b3555970c77ea75c728dae3b00b0677eccf8d4 - 8a9491658f3a370009323644b6b3555970c77ea75c728dae3b00b0677eccf8d4
a0542b9a031729d7e89fa27d9c1c4b1f584721be1a43f2289435838d74e925cb - a0542b9a031729d7e89fa27d9c1c4b1f584721be1a43f2289435838d74e925cb
bfa5cf5c8e27224640e8fca811d35746e92f03108ed5ce9cdaff868b6185e751 - bfa5cf5c8e27224640e8fca811d35746e92f03108ed5ce9cdaff868b6185e751
31cafc237ad9470c898e638b80c19b7a011daa8e06b2fa85b09c57173dfaac01 - 31cafc237ad9470c898e638b80c19b7a011daa8e06b2fa85b09c57173dfaac01
d46ff995bd3ea5c779538ad7c4b6d646500a787822639e23e50a5d864ac67bf1 - d46ff995bd3ea5c779538ad7c4b6d646500a787822639e23e50a5d864ac67bf1

Embedded URLs

http://jetcleanerpro.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

jetcleanerpro.com
jetcloud.com
k6.fr
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
oneclient.sfx.ms

Embedded IP addresses

4.150.223.96
4.230.171.124
52.253.84.76
48.211.4.16
135.233.45.222
20.184.175.14
51.11.192.51
20.42.179.192
52.148.114.188
20.42.65.91
20.42.73.28
85.210.196.11
40.84.97.4
20.42.179.204
172.215.188.232
40.84.85.40
52.123.252.215
72.145.35.109
52.110.12.14
52.110.12.22
52.123.252.197
172.172.255.218

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report