MALICIOUS — 53d2536c7c08d7be8235442b4ee119ac72e6847ec9d66f765cc4ba8c63872c33

MALICIOUS — 53d2536c7c08d7be8235442b4ee119ac72e6847ec9d66f765cc4ba8c63872c33 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the HUILoader family. 3 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 53d2536c7c08d7be8235442b4ee119ac72e6847ec9d66f765cc4ba8c63872c33
SHA-1: 150edf20ecaf3c99a4166701095aec3e8be6db4b
MD5: dea71b3301f37eabdc2b0aa55c87ed21
imphash: 8b550ab258e8f33e9a5161733ca078d7
ssdeep: 24576:q32ROf1IegqutJQ5FeQzcuC4r6HQmAw2:u2RAR5FeA6wHb
TLSH: T12D539ECF810F6A16D2FEC9246C1C96DC8842F0E8507ABB5C5A4B993D44A6137EEF40A5
Submitted as: 53d2536c7c08d7be8235442b4ee119ac72e6847ec9d66f765cc4ba8c63872c33
File type: pe · Size: 1045534 bytes
Verdict: malicious (96/100) · Family: HUILoader

Detections (3 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Genpack-9875154-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad

MITRE ATT&CK

T1056.001

Why this verdict

The malicious score of 96/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Malware.Genpack-9875154-0 (rule Win.Malware.Genpack-9875154-0) - engine signal, weight 0.90, confidence 0.95
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 17 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.gnu.org/software/coreutils/, http://translationproject.org/team/, http://gnu.org/licenses/gpl.html - static signal, weight 0.35, confidence 0.60
Extracted generic config (4 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.gnu.org/software/coreutils/
http://translationproject.org/team/
http://gnu.org/licenses/gpl.html
http://www.gnu.org/gethelp/
https://www.gnu.org/software/automake/manual/automake.html
http://fsmsh.com/2753
https://autotools.io/index.html
http://miller.emu.id.au/pmiller/books/rmch/
http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://go.microsoft.com/fwlink/?linkid=131534
http://go.microsoft.com/fwlink/?linkid=131531
http://go.microsoft.com/fwlink/?LinkId=130274
http://go.microsoft.com/fwlink/?LinkId=63443
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787728701&P2=404&P3=2&P4=G%2fR%2bLebIAH8LXkLx%2ftgb7FuN3LOoBLVMisBQilXMe2SZ1f4R11QtWhWN3C4vXZGELk33%2byaetUPA66JyRZ7UfQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.gnu.org
translationproject.org
gnu.org
cygwin.com
fsmsh.com
autotools.io
miller.emu.id.au
schemas.microsoft.com
go.microsoft.com

Embedded IP addresses

203.26.79.13
20.184.175.17
52.123.252.241
4.230.171.124
40.84.97.4
20.247.185.124
135.233.95.144
135.233.95.135
20.231.239.246
52.123.128.14
20.165.94.46
135.233.45.221
74.178.76.44
52.148.114.188
72.145.35.107
52.110.12.31
52.110.12.22

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report