MALICIOUS — 522f2a42a807a766c2de4b8ca4e98db7023ad1bd8f18d008b5d39d2cf613298d

MALICIOUS — 522f2a42a807a766c2de4b8ca4e98db7023ad1bd8f18d008b5d39d2cf613298d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Upantix family. 6 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 522f2a42a807a766c2de4b8ca4e98db7023ad1bd8f18d008b5d39d2cf613298d
SHA-1: a6a4bcaef64dbeab3b24496d92a455829e7676b2
MD5: 76552d450368937763e06f0d8347b74d
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 6144:5dkkkkkkuh+9L4l9T6DXRdkkkkkkuh+9L4l9T6DXyNrG5EFgYjloZ:5wh+pAMDhwh+pAMD9EFgM+
TLSH: T12647F1043636799CD7306F511550584DB22692C2893D2E9A8F030B693C7B8BBB9FCFA5
Submitted as: 522f2a42a807a766c2de4b8ca4e98db7023ad1bd8f18d008b5d39d2cf613298d
File type: pe · Size: 326014 bytes
Verdict: malicious (100/100) · Family: Upantix

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Upantix.GM!MTB (rule Trojan:Win32/Upantix.GM!MTB) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Packed.Win32.Upantix.gen (rule HEUR:Packed.Win32.Upantix.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
1 behavioral detection(s) across 1 rule(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 7 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1479 behavior events · 0 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Windows\win32dc\Doom 3 + cdfix.exe - 8d853d61b31363131be36366ddf1f7c554294b6b423c2d2b5c20650d0e495244
C:\Windows\win32dc\FlatOut_cdfix.exe - 54f5f1990a5047aebc1e351cf8f84639cfdfb5c348d0114889a9b94487aff7f9
C:\Windows\win32dc\DAoC_fix.exe - 9998e1b2d2d112d405074e1fc5ab8cd856242324e3778c8e842e2afa750232e6
C:\Windows\win32dc\Doom 3 + hack.exe - 267dfa296fb9871a158947047850378e99a9db2aabaaf1a45f097fc27be4332d
C:\Windows\win32dc\Counter-Strike crack.exe - 504f4c8b6c4fcf8789fe2c4daa09cd9fff454247f7259a295366983bd449d6f8
C:\Windows\win32dc\FlatOut_crack.exe - ba09f0b52de3350944a5843a57b986ea5391c359ac3569c3fc5e655bace76e55
C:\Windows\win32dc\DAoC_nocd.exe - 446a5b07b7da4d78874ec6b6452d7f83c397929c88ab8b4c8803d5666f8f5015

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

aefd.nelreports.net
us.undernet.org
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.65.94
52.123.252.232
172.215.188.225
4.230.171.124
4.144.132.114
104.46.162.230
135.232.92.137
135.232.92.97
13.89.179.15
40.84.85.40
135.233.95.144
199.71.214.87
20.42.65.90
52.148.114.188
52.110.12.14
92.223.78.30
72.145.35.105

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report