MALICIOUS — 679848b2cebc8c002559e10f854bb5e5e0bb244af203afdf4f43bbe1200219b2

MALICIOUS — 679848b2cebc8c002559e10f854bb5e5e0bb244af203afdf4f43bbe1200219b2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the HUILoader family. 6 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 679848b2cebc8c002559e10f854bb5e5e0bb244af203afdf4f43bbe1200219b2
SHA-1: 6705595cc5b21ae260273bc4e9d8dfc063c2b37a
MD5: b2dff1b796d9194734a9ccde32320994
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 1536:3UUUUUUUUUUHdTD+vvvvvvvvvh+UUUUUUUC9mIkkkkkkTyhhhhhhhMSTZM+9m2OY:blN9RkkkkkkTLSBvL
TLSH: T1163AD040757A388CDB309F611924594DA12152C28A7C3DDB9B030B2D2D778FBB8E8E76
Submitted as: 679848b2cebc8c002559e10f854bb5e5e0bb244af203afdf4f43bbe1200219b2
File type: pe · Size: 97386 bytes
Verdict: malicious (99/100) · Family: HUILoader

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Generic-9908425-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9908425-0 (rule Win.Trojan.Generic-9908425-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (HUILoader): Counter-Strike_crack.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 29 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

367 behavior events · 1 ATT&CK techniques · 10 dropped files.

Dropped files

C:\Windows\win32dc\Counter-Strike_crack.exe - d303333a120d7ad61e9ba684d87f113f53054119085341a3d47c517a0b85eef0
C:\Windows\win32dc\FlatOut_codes.exe - 617d5426885a32d6b2f91cdaa0f4225ff1fa0f8768a712539a8460ebd4d5647b
C:\Windows\win32dc\UT2004(hack).exe - 212029d42f47cb7cfbab8d825493309b05a51e03f6822afc1ab2df90a3ef9546
C:\Windows\win32dc\BattleField 1942 trainer.exe - 8634c50a63e73a4db5c06078246f3fb6ba4e292eea1661963c830474d818c2fb
C:\Windows\win32dc\Half-Life 2 + fix.exe - 37ad81717019ce9fe4183e60228fab0f9495436059044b76fa0c91fe3e005e18
C:\Windows\win32dc\Quake3(cdfix).exe - 93eb3e73e98c5d20829a015d3b0f65b5685beae9f8d8c14fee35c39e7b7490d0
C:\Windows\win32dc\DAoC(crack).exe - 24aafcf9f690c9419d341bb85e6343b324dcc9d99eea03b0ae7a7e4145ac4a97
C:\Windows\win32dc\Sims 2 + codes.exe - e3a806b642659d079ccc470efc16dfa2471a5404c866a339834f124738ff91b5
C:\Windows\win32dc\BattleField 1942 + patch.exe - 70e632a1fc677272d851092710f7afc00d90aba34e464575cca4c04690e9ac31
C:\Windows\win32dc\FlatOut + hack.exe - 1d4a04a2e0e9f9dc4ad597c54f8be86f7d10d4e95b957d7ab5b3671f46029a45

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

us.undernet.org

Embedded IP addresses

13.89.179.15
57.154.63.210
4.230.171.124
20.247.185.124
74.178.76.44
20.165.94.54
135.232.92.137
13.89.179.12
172.178.240.163
74.178.76.54
162.159.36.2
203.26.79.13
52.123.129.14
186.233.185.155
92.223.78.30
4.247.188.224
135.233.95.144
52.148.114.188
52.123.128.14
135.234.160.245
20.184.175.12
20.236.44.162
40.103.64.226
40.99.134.18
162.159.142.9

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report