MALICIOUS — 5a2567285eb63c83ea96e895de32bdc7d23ce1e712f0d9be349d6187779eb8b9

MALICIOUS — 5a2567285eb63c83ea96e895de32bdc7d23ce1e712f0d9be349d6187779eb8b9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upantix family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 5a2567285eb63c83ea96e895de32bdc7d23ce1e712f0d9be349d6187779eb8b9
SHA-1: 575f7a7bd7f930b15382cd4e474b8e4366ebb0cf
MD5: 0635eef343ef6baf9650f003c4ff68bf
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 6144:5dkkkkkkuadkkkkkkuSdkkkkkkuadkkkkkku1dkkkkkkuadkkkkkkuSdkkkkkkuI:5wawSwaw1wawSwawMyn4P
TLSH: T19D51E000327A399CD7609F605524598DA22152C1897D3DEA9B030B6D3CB78BBBDE8F71
Submitted as: 5a2567285eb63c83ea96e895de32bdc7d23ce1e712f0d9be349d6187779eb8b9
File type: pe · Size: 911236 bytes
Verdict: malicious (99/100) · Family: Upantix

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Upantix.GM!MTB (rule Trojan:Win32/Upantix.GM!MTB) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Packed.Win32.Upantix.gen (rule HEUR:Packed.Win32.Upantix.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 8 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

189 behavior events · 0 ATT&CK techniques · 8 dropped files.

Dropped files

C:\Windows\win32dc\Half-Life 2 hack.exe - b2360c62784ca79fba5d6763b7eb4419059f185bcf4097cf15010ec676ab47e1
C:\Windows\win32dc\Sims 2 + crack.exe - f298e4e151cea9c38dff2fc7f625bab1715347958121e823fcd18e918dd4e22c
C:\Windows\win32dc\Doom 3 + nocd.exe - 52380201a31cdbc1ef88e78550ab5030023f5342c82a1339752fcb214a61d617
C:\Windows\win32dc\UT2004 nocd.exe - f1473c4aa1323b725d7c632653bb6178f6136a9171366b5a51e61d3b7c5d4a89
C:\Windows\win32dc\FlatOut_codes.exe - 0d5cec7a9a67c69c69d437f06187e0d40d39ff2e6117437c13fee25ca0237606
C:\Windows\win32dc\FlatOut + nocd.exe - f90c1ad3f44d141ce79889daec1372359c56a8d866dd90f00a0d4b49e76b8873
C:\Windows\win32dc\UT2004 + cdfix.exe - ee8b174a310900babbd115a62b9d97003e5383cc3761d13912cd8531813af1ce
C:\Windows\win32dc\Counter-Strike_fix.exe - 8d1ca964428e9f424076bfd87746c4d4fafdf67c04e84f152eb897fc955d0586

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

20.184.175.1
4.230.171.124
57.154.63.210
52.230.59.222
74.178.76.54
20.89.1.11
135.233.95.144
104.18.33.89
20.184.175.13
72.145.35.102
52.148.114.188
52.110.12.28
52.110.12.19

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report