MALICIOUS — Sims 2 + crack.exe

MALICIOUS — Sims 2 + crack.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 6776ec2fbb2ed15093bdb9ada12ac3a7fedd8fd75bd8cdc6641b4e773cb87c78
SHA-1: c6fc59e2fd3f56302924e0e8932dfd6c5630a456
MD5: db51e7f9f297b762de31122d037baa56
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 12288:5wawSwaw1wawSwaw9zJwawSwaw1wawSwaw9zswawSwaw1wawSwaw9zJwawSwaw1w:o
TLSH: T1A460D100327A399CD7709F605524598DA22552C1897D3EEA9B03072D3CB78BBB9E8F71
Submitted as: Sims 2 + crack.exe
File type: pe · Size: 3528592 bytes
Verdict: malicious (98/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 30 external host(s) at runtime (28 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 7 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1633 behavior events · 0 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Windows\win32dc\Counter-Strike cdfix.exe - 1a7bc43443e069d2f00a0aff7e24885b7c2a0a38e30d03267c358fe3bc6c690f
C:\Windows\win32dc\Quake3 + hack.exe - 87896c7dbf1f5067bf21b44821a5ac0c13347ea28afcb91a93705f07cdc17b9f
C:\Windows\win32dc\Doom 3(patch).exe - 15a12ec24a7b596468fed3fa506b0f7d7d89af6038361c351251b061464645ea
C:\Windows\win32dc\Silent Hill 4(trainer).exe - 2190d4e141d37988615c824f31ee35d988194c3ede7dd8c9e5794ea31c00b9fd
C:\Windows\win32dc\Doom 3(hack).exe - 32fde5b5bdcd18feace30dec4f25ea8736a005177d5daff765841b2424a6d4c9
C:\Windows\win32dc\Silent Hill 4 + fix.exe - c167c71366cb9fc4a866c895146e4dc9bcef3f64bfce4e4a275050c86d7c035e
C:\Windows\win32dc\Counter-Strike + crack.exe - 5b427efc215c6720808c1882ec64617ce4f2dbdd79cef1b84354102f5aa93944

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787644382&P2=404&P3=2&P4=R2k3vjg7RpTQn6ljiIGpxEBShq8g833ZxGkfH8waPOo5lgQmuBhpaJv2LKGVEmkiWg8FfDGIdVWg0f5cR9NiIw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787644467&P2=404&P3=2&P4=VZxFRmn4ngbLS3LWmfoCLwL%2b%2fSmNZZpRdjWI5Er5lHQgngVZB6iB5kQ7MibssATB17Xa5VfR1wcgeQE6RYsJlg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787041223&P2=404&P3=2&P4=Yc81kCTgQFXc937DMDOViv1VG%2b4WNzCLMtXi2gDWVDZOYkiRVU9j9merPFgP7AndOGc0jzrwP11PcxSYNV8Q5w%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787040759&P2=404&P3=2&P4=GHjs1OSmVyGVcB89to9KDcpMia2AtDwGgck4cchYpRUdFyPGl3kQRLTyrlBYW9Yy%2f1yvnZPGFCWyRbggevkOag%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

us.undernet.org

Embedded IP addresses

4.150.223.98
57.155.104.224
57.155.101.212
4.230.171.124
20.247.184.197
74.179.77.204
52.168.117.168
135.232.92.97
20.112.250.133
40.99.133.242
52.123.129.14
52.123.128.14
52.123.252.231
20.184.175.20
203.26.79.13
142.251.42.99
172.66.2.5
172.178.240.163
135.232.92.34
172.83.156.122
52.148.114.188
92.223.78.30
52.110.12.3
52.110.12.51
72.145.35.108

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report