MALICIOUS — Counter-Strike + hack.exe

MALICIOUS — Counter-Strike + hack.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 42a1a8d5435f5f4020335668b32393c769e66c520f7652b9320d1a3e74126ab7
SHA-1: 5d082d92f7c25d9e6a0730ae3c83469fb6bdf9b0
MD5: 7f9eb1aebc4f8b0d81072f3a9875d2f8
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 12288:5wawSwaw1wawSwaw9zJwawSwaw1wawSwaw9zswawSwaw1wawSwaw9zJwawSwaw1W:e
TLSH: T11F60D100327A399CD7709F605524598DA22552C1897D3EEA9B03072D3CB78BBB9E8F71
Submitted as: Counter-Strike + hack.exe
File type: pe · Size: 3526597 bytes
Verdict: malicious (99/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7080) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
1 behavioral detection(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 7 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1284 behavior events · 0 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Windows\win32dc\Quake3_crack.exe - 0fb8429a69401d7665d10cccb8a4d2fea635bf36dc8e2f96d7e1db5d5f280a5a
C:\Windows\win32dc\Half-Life 2 + cdfix.exe - 226e7412f0ae925a0bec6ab99ab8619d76437b3dcc640ea7a60e6fa375af88cc
C:\Windows\win32dc\BattleField 1942(trainer).exe - 2c80f7b3a1d747dae7da597bca259e935e20472c76698afcc879c7c740ca34a4
C:\Windows\win32dc\DAoC_hack.exe - 88e2ee6f0feb4383aaf9c8caa0431f6854036fb4493c8e64e69fc496bb363dd9
C:\Windows\win32dc\Counter-Strike + patch.exe - d89e3aab58bd2be9d2a976c3498304229fcdecaefa339d872e2d87780d61696d
C:\Windows\win32dc\Silent Hill 4 + codes.exe - 27adee4dfee269e110ce7ba071b1fab453c11b08641900b011a7291c9f5c2b83
C:\Windows\win32dc\FlatOut_cdfix.exe - 676416eb1e176e2f4d986f15968d0982538432f61de7531d8b3755a5ab0f4c34

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787643320&P2=404&P3=2&P4=B1Ev%2f%2figIsdpt%2bNCC2LnfciQ2a%2f2DIe6Jr614%2fDOwm1rNO3jaXl457JZH%2fzYJhI9U7f1RskjBQvI03X7Lg36Bg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787643363&P2=404&P3=2&P4=TGjMLbEAgZuzfRR5MqbbvRVngikEwgNilbFe3tDedAQtATm%2bxEGc6rZg30vHHMTTWkAGoS1SjUitVJtI95dztw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

us.undernet.org

Embedded IP addresses

20.165.94.46
172.83.156.122
51.104.15.252
4.247.188.224
4.144.132.114
4.230.171.124
74.179.77.204
74.179.77.164
20.42.65.90
4.150.223.97
20.231.239.246
52.123.128.14
52.123.129.14
203.26.79.13
74.178.76.128
135.232.92.34
52.123.252.215
135.233.45.222
186.233.185.155
52.148.114.188
52.110.12.14
52.110.12.16
162.159.142.9
72.153.5.131
4.209.250.170

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report