MALICIOUS — 2e460a282ecdc07892a9f1fe66b90bb758d55e337e3dee4e279220e9dd927e7d

MALICIOUS — 2e460a282ecdc07892a9f1fe66b90bb758d55e337e3dee4e279220e9dd927e7d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (90/100), attributed to the HUILoader family. 7 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 2e460a282ecdc07892a9f1fe66b90bb758d55e337e3dee4e279220e9dd927e7d
SHA-1: c03c38362d7b3564e26a12736f1bf3b7536a6346
MD5: 24357a5710181ea83c7fd1751ff0e35d
imphash: b2984619d182e8ed71d948ffed1462a2
ssdeep: 196608:BIk98Q2IdKcBH6n2IrF89bYzbYGwVXD/HijK+bd4nHyVA9:Bj89Id5BH62IJ89YzFwt/CjKwuHSK
TLSH: T1EF668D5A1B29528FD7A0B600D73455CE24C05C93907EAF4840C7113DA3DBBB7E7AA1EA
Submitted as: 2e460a282ecdc07892a9f1fe66b90bb758d55e337e3dee4e279220e9dd927e7d
File type: pe · Size: 6684845 bytes
Verdict: malicious (90/100) · Family: HUILoader

Detections (7 of 55 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Conteban.A!ml
Emsisoft (Emergency Kit): Trojan.Generic.38754562
Kaspersky (KVRT): UDS:Trojan-Downloader.Win32.Adload

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 90/100 is the fusion of 6 weighted signals:

Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 23 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://purl.org/dc/elements/1.1/, http://zentimo.com - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

209 behavior events · 0 ATT&CK techniques · 2 dropped files.

Dropped files

a12b5b12e147c7aeb3c85b2adba3c3c7b9635d114660be0421454d94710963fe - a12b5b12e147c7aeb3c85b2adba3c3c7b9635d114660be0421454d94710963fe
becc2fa42f9f05320919812808c2e43ba84a032728e77aeda89929d353d241af - becc2fa42f9f05320919812808c2e43ba84a032728e77aeda89929d353d241af

Embedded URLs

http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://ns.adobe.com/xap/1.0/
http://purl.org/dc/elements/1.1/
http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://schemas.microsoft.com/SMI/2016/WindowsSettings
http://zentimo.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787838100&P2=404&P3=2&P4=lDduf4ftFRRdq6Zsj6tAIGydsEoAd%2bBkbhYZvxGXkFaaTaRLNvaylqYAJlXqjFYs71ry0K0VwE8ic3tRegsCaQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

k.us
www.w3.org
ns.adobe.com
purl.org
schemas.microsoft.com
zentimo.com
olustgtapi.live

Embedded IP addresses

57.155.104.224
20.89.1.8
20.247.185.124
4.230.171.124
20.42.179.204
135.233.95.144
135.233.95.135
20.42.65.88
20.76.201.171
52.123.129.14
52.123.128.14
40.99.134.2
52.182.143.212
135.234.160.244
52.110.12.49
135.233.45.222
52.110.12.55
203.26.79.13
20.165.94.46
52.148.114.188
72.153.5.130
52.110.12.24
52.110.12.32

File paths

I:\(
E:\g{0.

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report