MALICIOUS — flux.exe
MALICIOUS — flux.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (79/100), attributed to the HUILoader family. 2 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
6486d8340e2c409d2c85c0b064133a2e7c80889b80dbb7c27ab83635dd48c33f - SHA-1:
afe9eb7811c1aa6ba577dfd885b448b13de9d122 - MD5:
2e3e2ecc94f3d75d6e2de5e850d39bcd - imphash:
afd82ab415c2958a21ddf294e1012a47 - ssdeep:
24576:jCt/2ZZ61TtK83kr4nWu97zlmKTMPIm1ei3dgNbWWV4S8UZLgQbKSVnl+RMdtCgL:ciYDu4WRURgChMO3 - TLSH:
T15457B076DD92AB06D2F1E6E0EC34A78C1073B8A851771EC8F38BD06C26D9C471875299 - Submitted as: flux.exe
- File type: pe · Size: 1536232 bytes
- Verdict: malicious (79/100) · Family: HUILoader
Detections (2 of 55 engines)
- capa (capabilities): capability:collection/keylog
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
MITRE ATT&CK
Why this verdict
The malicious score of 79/100 is the fusion of 5 weighted signals:
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - capa (capabilities) flagged capability:collection/keylog (rule
capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://api.fluxometer.com, https://justgetflux.com/windows/lights.html, https://justgetflux.com/winmap.html - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://api.fluxometer.com
- https://justgetflux.com/windows/lights.html
- https://justgetflux.com/winmap.html
- https://justgetflux.com/update/v4/
- https://justgetflux.com/update/v4/windows.json
- https://justgetflux.com/windows/preset.json
- https://justgetflux.com/offer/windows.json
- https://justgetflux.com/windows/watchdog.html
- https://justgetflux.com/
- https://fluxometer.com/
- https://justgetflux.com/crash
- https://justgetflux.com/windows/contribute.html
- https://justgetflux.com/windows/support.html
- https://justgetflux.com/windows/forum.html
- https://justgetflux.com/windows/release.html
- https://justgetflux.com/windows/moreabout.html
- https://justgetflux.com/geo
- https://discovery.meethue.com/
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
- http://schemas.microsoft.com/SMI/2013/WindowsSettings
- http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
- https://sectigo.com/CPS0
Embedded domains
- api.fluxometer.com
- justgetflux.com
- fluxometer.com
- discovery.meethue.com
- schemas.microsoft.com
- crl.comodoca.com
- cacerts.digicert.com
- crl3.digicert.com
- crl.sectigo.com
- crt.sectigo.com
- sectigo.com
Embedded IP addresses
- 239.255.255.250
- 1.0.0.1
File paths
- c:\Users\mherf\git\projects\flux\NoAccount\flux.pdb
- X:\:`:d:
- X:\:`:d:h:l:p:t:x:
- X:\:l:p:t:x:
More HUILoader samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report