MALICIOUS — 592c4b9e352073c126277576c7b4b2e1647c4737be6fa704fa54956c0ba3c11c

MALICIOUS — 592c4b9e352073c126277576c7b4b2e1647c4737be6fa704fa54956c0ba3c11c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Upantix family. 6 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 592c4b9e352073c126277576c7b4b2e1647c4737be6fa704fa54956c0ba3c11c
SHA-1: a9639d48ca643ddb866a5bcd40faf31e1770870b
MD5: 15ed5cb9226489bd50108dff5d0a2184
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 6144:5dkkkkkkuadkkkkkkuSdkkkkkkuadkkkkkkuRGbadkkkkkkuaTHU:5wawSwawRGbawaT0
TLSH: T1144DD100327A399CC7709F605524958DA22552C189793EEA8B03072D3DB78BBBDE8F75
Submitted as: 592c4b9e352073c126277576c7b4b2e1647c4737be6fa704fa54956c0ba3c11c
File type: pe · Size: 611284 bytes
Verdict: malicious (100/100) · Family: Upantix

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Upantix.GM!MTB (rule Trojan:Win32/Upantix.GM!MTB) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Packed.Win32.Upantix.gen (rule HEUR:Packed.Win32.Upantix.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
1 behavioral detection(s) across 1 rule(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 7 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1313 behavior events · 0 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Windows\win32dc\DAoC + cdfix.exe - 3a15a16761671cf862114a5cc9bf1f4750d2825f078255257dc2c675d48f16fe
C:\Windows\win32dc\Counter-Strike(patch).exe - ba4e0e35cfa618cd66beb947c7b314165e3bcc30eb5bc45bbca448a1efc7b1a7
C:\Windows\win32dc\UT2004(trainer).exe - 11e932c669529437b1f7a684fb4986fcfc3ee647c380f4430877b9b7a87fef24
C:\Windows\win32dc\Sims 2(cdfix).exe - e7889172bdb09faf4abd3b5d8b217ed6c557c4c4c07d8223b51b9476ab820d83
C:\Windows\win32dc\Quake3(nocd).exe - 39552a9ee3f1fea2f383a5561f2376b13f537799c5e268b8df1a33e1b26617da
C:\Windows\win32dc\FlatOut(crack).exe - 073a4c1dbf6335e3337aa2a04a8d1288e3e8f78202b1d1de8d3fcd8557abdfe2
C:\Windows\win32dc\Counter-Strike cdfix.exe - 4645940b0e3d9e8bdc27b4b42c15671cdba72385b2643bddeeca51052427b90d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

us.undernet.org
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

13.89.179.12
4.230.171.124
4.247.188.224
4.144.132.114
172.215.188.232
74.179.77.204
20.165.94.54
4.150.223.101
104.18.33.89
186.233.185.155
52.110.12.52
52.110.12.10
125.56.205.42
125.56.205.32
92.223.78.30
52.110.12.11
52.110.12.46
52.148.114.188
72.154.7.16

File paths

R:\A[f

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report