MALICIOUS — 5e65f8d81082e94000da6793a2c3c1395f93f11f623541aee829b36e6b71d6c8

MALICIOUS — 5e65f8d81082e94000da6793a2c3c1395f93f11f623541aee829b36e6b71d6c8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 8 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 5e65f8d81082e94000da6793a2c3c1395f93f11f623541aee829b36e6b71d6c8
SHA-1: 3024b100dbb58a51b6acc29d4af1e143e9b131b6
MD5: 0db95ce177e5904303b6727013db7be1
imphash: 435ddb61824cf7b0d9a2eafc9fb30194
ssdeep: 3072:adEUfKj8BYbDiC1ZTK7sxtLUIGcly6aqOn7ACE89zMfo0z3YRmmG8L:aUSiZTK40wbaqE7Al8jk2jL
TLSH: T16642EF5819A1EBB8E1CB8D4BE824D7ECFA47DC8D6775790C012323B44B5A103D9A4B1B
Submitted as: 5e65f8d81082e94000da6793a2c3c1395f93f11f623541aee829b36e6b71d6c8
File type: pe · Size: 211548 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (8 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Generic-9856964-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/QQPass!pz
Emsisoft (Emergency Kit): Gen:Variant.Stealer.229
Trellix Stinger (McAfee): Trojan-FFZL!256442600CEC
Kaspersky (KVRT): Trojan.Win32.Scar.oetk

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Malware.Generic-9856964-0 (rule Win.Malware.Generic-9856964-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/QQPass!pz (rule Trojan:Win32/QQPass!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Stealer.229 (rule Gen:Variant.Stealer.229) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FFZL!256442600CEC (rule Trojan-FFZL!256442600CEC) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Scar.oetk (rule Trojan.Win32.Scar.oetk) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

18734 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\qpath.ini - 88e5a67d07861e9d960e3c7853c183b93abd4cd3344ec4d482e76c0e17f3b085
C:\Users\analyst\AppData\Local\Temp\Sysqemsmfzj.exe - 73dbb15b3aad4384476cc9f65fe0286a160227cfff46ab7c899a299c96396b90
C:\Users\analyst\AppData\Local\Temp\Sysqamqqvaqqd.exe - 64ab1206e4f45a2a21716dd9ae61f9467958d9d72ac870409ef60f7cdf33efc2
cb048d0583225882d96220e22591650ebbd2c209985f39c604516eea2ee8f131 - cb048d0583225882d96220e22591650ebbd2c209985f39c604516eea2ee8f131

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

ietuku.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.101
52.123.252.229
57.155.104.224
4.230.171.124
4.144.132.114
74.179.77.204
135.232.92.97
135.232.92.137
20.42.65.85
20.184.175.3
135.234.160.246
20.184.175.6
4.150.223.114
135.234.160.245
72.154.7.109
52.148.114.188
52.110.12.14
52.110.12.2

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report