MALICIOUS — 4268fbe59c3ea3376dc39189f790e43fa0f6916b07825cb0bd878f1abc2a7a19

MALICIOUS — 4268fbe59c3ea3376dc39189f790e43fa0f6916b07825cb0bd878f1abc2a7a19 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upantix family. 6 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 4268fbe59c3ea3376dc39189f790e43fa0f6916b07825cb0bd878f1abc2a7a19
SHA-1: bde7e42b28954aa78ed46cf80a037a779d17a4fc
MD5: 4422e6ea2d3074f9b2abe5c661d60647
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 6144:5dkkkkkku21Fdkkkkkku21W14OdkkkkkkoQcGpdkkkkkku21Fgmy65dZTuOW:5w23w2Q14O2QTw23gC5dZLW
TLSH: T11D4CE040327A348CCB34AF605514999DA26592C5897D3EDA4B03071C3DB78BBB9E8FB1
Submitted as: 4268fbe59c3ea3376dc39189f790e43fa0f6916b07825cb0bd878f1abc2a7a19
File type: pe · Size: 542013 bytes
Verdict: malicious (99/100) · Family: Upantix

Detections (6 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX 3.91
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (HUILoader): e5a2206889e3bb1d3a7ec3d298f295f52ee7c13e7cd03545cbe9b1b372f86e50 - dynamic signal, weight 0.80, confidence 0.90
1 behavioral detection(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 56 external host(s) at runtime (17 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:UPX 3.91 (rule DIE:UPX 3.91) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, UPX 3.91 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

1311 behavior events · 1 ATT&CK techniques · 4 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/25555/files/e5a2206889e3bb1d3a7ec3d298f295f52ee7c13e7cd03545cbe9b1b372f86e50 - e5a2206889e3bb1d3a7ec3d298f295f52ee7c13e7cd03545cbe9b1b372f86e50
/opt/CAPEv2/storage/analyses/25555/files/bfbc5baee661b117f150830e94a2836ceb4237fbb56900d1f1d6ca39385a9ff7 - bfbc5baee661b117f150830e94a2836ceb4237fbb56900d1f1d6ca39385a9ff7
/opt/CAPEv2/storage/analyses/25555/files/c4c88d0f6e65c4a97809046c5f42520679e10674e8b36d8b3a201853d860a46b - c4c88d0f6e65c4a97809046c5f42520679e10674e8b36d8b3a201853d860a46b
/opt/CAPEv2/storage/analyses/25555/files/fa7bb30dc0940f138ce4f32a2df9686e84f2006db6c449f4769a772231e3f2ef - fa7bb30dc0940f138ce4f32a2df9686e84f2006db6c449f4769a772231e3f2ef

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

us.undernet.org

Embedded IP addresses

52.123.252.233
4.150.223.102
52.110.12.49
4.230.171.124
172.215.188.232
135.233.95.144
4.150.223.113
20.112.250.133
135.233.45.221
52.110.12.1
20.236.44.162
4.150.223.114
4.144.132.114
199.71.214.87
74.178.240.51
135.232.92.137
135.233.45.222
40.84.97.4
4.150.223.96
20.165.94.63
162.159.36.2
52.230.60.54
52.110.12.56
52.110.12.10
85.210.196.11

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report