MALICIOUS — 54cced00a924003bbfecfb69e49de60f0a6bc4f179cf8d76e839e4f1c4fa7477

MALICIOUS — 54cced00a924003bbfecfb69e49de60f0a6bc4f179cf8d76e839e4f1c4fa7477 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the HUILoader family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 54cced00a924003bbfecfb69e49de60f0a6bc4f179cf8d76e839e4f1c4fa7477
SHA-1: c3e228f93161509745ceab7cce23c32035791fd8
MD5: 041c6955a23d04d92e7185d345f36e7e
imphash: 8de83de163133d54b3ee900548ff55fe
ssdeep: 24576:HCSCEN97U8CWhyi+28JaSAFU8/8ACrIVN:iSCEN9oZqyi+2xSAU8kA
TLSH: T127556BAA415B2603C9F7EB10B86205EC5AA5765858749ECD4707F87900E3F37D8328FA
Submitted as: 54cced00a924003bbfecfb69e49de60f0a6bc4f179cf8d76e839e4f1c4fa7477
File type: pe · Size: 1220608 bytes
Verdict: malicious (99/100) · Family: HUILoader

Detections (5 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Generic-9907165-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9907165-0 (rule Win.Trojan.Generic-9907165-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in tsk_0c1a474997 (pid 8104) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.eyuyan.com - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

15 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

f23d5d5794b32b0b8352613612890050b5cff7e7f46999584fb21eef01bc1ae1 - f23d5d5794b32b0b8352613612890050b5cff7e7f46999584fb21eef01bc1ae1

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.eyuyan.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

crl.microsoft.com
www.microsoft.com
www.eyuyan.com

Embedded IP addresses

4.150.223.100
4.230.171.124
4.247.188.233
52.253.84.76
135.232.92.97
20.184.175.20
135.232.92.137
74.179.77.204
52.182.143.212
172.64.154.167
57.155.104.224
92.223.78.30
52.110.12.37
52.110.12.45
72.153.5.61
52.148.114.188
52.110.12.51
52.110.12.50

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report