SUSPICIOUS — 4b37e2700bc25380f9f7410a3b00037ac95dccf5a2ecaa146915d82e67cacb63

SUSPICIOUS — 4b37e2700bc25380f9f7410a3b00037ac95dccf5a2ecaa146915d82e67cacb63 is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (66/100), attributed to the HUILoader family. 4 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 4b37e2700bc25380f9f7410a3b00037ac95dccf5a2ecaa146915d82e67cacb63
• SHA-1: 119e2c661c6d7d928bd21a08332849df1c7282eb
• MD5: be70454a12416143415505f7632f3d26
• imphash: 933d7c1977c5f484698b761fbb367569
• ssdeep: 3072:N/mcF4VIe4zflQhBeAsU4ZLN70eZZ1USsJL0k2/yHJ/WQ1vuQn1w:NnUI7ZQhBeAN4ZLx0eZZ1Uxp/BuQm
• TLSH: T17B465C9A7008979BF7730F6188E14D0DE0A360E984FE04951FC7CCAD6B78CDB58A5269
• Submitted as: 4b37e2700bc25380f9f7410a3b00037ac95dccf5a2ecaa146915d82e67cacb63
• File type: pe · Size: 303104 bytes
• Verdict: suspicious (66/100) · Family: HUILoader

Detections (4 of 55 engines)

• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Emsisoft (Emergency Kit): Gen:Trojan.StartPage.syW@aikUpPib
• Kaspersky (KVRT): UDS:Trojan.Win32.StartPage

MITRE ATT&CK

• T1071.001
• T1057

Why this verdict

The suspicious score of 66/100 is the fusion of 5 weighted signals:

• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://stat.myl23.com/api.jsp?data=, http://www.9486.cn/, http://www.9522.cn - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://stat.myl23.com/api.jsp?data=
• http://www.9486.cn/
• http://www.9522.cn
• http://www.8009.com
• http://www.kwxf.com
• http://about.blank.la/
• http://www.kwxf.com/
• http://about-bank.cn/
• http://live.gglike.cn/install.exe

Embedded domains

• stat.myl23.com
• www.9486.cn
• www.9522.cn
• www.8009.com
• www.kwxf.com
• kzxf.net
• www.kzxf.net
• about-bank.cn
• live.gglike.cn
• about.blank.la

Embedded IP addresses

• 58.215.65.193

File paths

• C:\Program
• C:\Documents
• d:\program
• f:\vs70builds\3077\vc\MFCATL\ship\atlmfc\include\atlbase.inl
• f:\vs70builds\3077\vc\MFCATL\ship\atlmfc\include\atlcom.h
• f:\vs70builds\3077\vc\MFCATL\ship\atlmfc\include\atlwin.h
• f:\vs70builds\3077\vc\MFCATL\ship\atlmfc\include\atlcomcli.h
• f:\vs70builds\3077\vc\MFCATL\ship\atlmfc\include\atlexcept.h
• f:\vs70builds\3077\vc\MFCATL\ship\atlmfc\include\atlbase.h
• f:\vs70builds\3077\vc\MFCATL\ship\atlmfc\include\atlsimpcoll.h
• f:\vs70builds\3077\vc\MFCATL\ship\atlmfc\include\atlconv.h
• f:\vs70builds\3077\vc\mfcatl\ship\atlmfc\src\atl\atls\AtlTraceModuleManager.h
• f:\vs70builds\3077\vc\crtbld\crt\src\sprintf.c
• f:\vs70builds\3077\vc\crtbld\crt\src\vsprintf.c
• f:\vs70builds\3077\vc\crtbld\crt\src\vswprint.c
• f:\vs70builds\3077\vc\crtbld\crt\src\swprintf.c
• f:\vs70builds\3077\vc\crtbld\crt\src\output.c
• f:\vs70builds\3077\vc\crtbld\crt\src\_flsbuf.c
• e:\App\web\kwxf\web\Debug\web.pdb

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report