MALICIOUS — 69e41825f15c5e4ca453de7ebc7bfc0aadc131758735a3cb2bdac5d90bdaf1a2

MALICIOUS — 69e41825f15c5e4ca453de7ebc7bfc0aadc131758735a3cb2bdac5d90bdaf1a2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 8 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 69e41825f15c5e4ca453de7ebc7bfc0aadc131758735a3cb2bdac5d90bdaf1a2
SHA-1: 444e01531fdf0859cb6b386e82a54bff4fca18d7
MD5: ba5c6c4a557b1ba9182fa31305931c6b
imphash: 38aa7c2ff6ef0e48a9520d6702d08df4
ssdeep: 1536:40nERoZtEEq3GcOrFhNGpWMlWhj/GFhNGpW+lwlR:NnEOtEEqSFhNGpWTwFhNGpWj
TLSH: T1EB3BB75B1430F929E3E0408F112CBABE41C99C325F75568662E4E6E0466443BA36FF6F
Submitted as: 69e41825f15c5e4ca453de7ebc7bfc0aadc131758735a3cb2bdac5d90bdaf1a2
File type: pe · Size: 104958 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (8 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Agent-6943819-1
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Trellix Stinger (McAfee): PolyPatch-UPX
Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-6943819-1 (rule Win.Trojan.Agent-6943819-1) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Sivis.A (rule Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PolyPatch-UPX (rule PolyPatch-UPX) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Agent.es (rule Virus.Win32.Agent.es) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

18414 behavior events · 0 ATT&CK techniques · 97 dropped files.

Dropped files

C:\Program Files\7-Zip\Lang\el.txt - 56370f24e1c595be51d9c1d58832044a7dcf8a48f8f1cd736e9d0865153fd6b5
C:\Program Files\7-Zip\Lang\af.txt - fa76f1ea7f6fb9c5dde9ba179d11ca71e2c0c012c01efa288fe9e4f498bc457b
C:\Program Files\7-Zip\Lang\mng.txt - b2846d41cb51188a4d8b685c638fd4a00385a823da81de71eda5af7e97e2bb09
C:\Program Files\7-Zip\Lang\fur.txt - dc1a594a619387cf9644f5c0b1fac9e8505a95dd6c092d342c20c061b7fecd22
C:\$WinREAgent\Backup\SrSettings.ini - 2243dfc608a90fa3d8f3f59d49f846e1ddae709a38e0a28f98f052053d5e0546
C:\office-config.ps1 - 20c0ccdd7d2cbd6f53eeb2c4a34481c340652ee1792bab034169b7ff268a7774
C:\Program Files\7-Zip\Lang\ext.txt - 57ba13a46cae664a8bb590279496b77d620a7054182086f86347f8d16ccd1201
C:\bake.ps1 - afad82455df430cc505c3d9a686789b64d1e04feb278c134c78ca2f650f8af1a
C:\Program Files\7-Zip\7z.sfx - cc51c4fc79e42c1d9f891303ccbcb3781e23c6893da092335facd3fffb71aa6b
C:\Program Files\7-Zip\Lang\mr.txt - a81ce52fb3eaaa64ab8980757883006d884953681f0b5ab6c770b12ff1e01e82
C:\$WinREAgent\RollbackInfo.ini - f561274958ff6afba35a72da3d47f5a14c73179397955f8d0904e7da40eafa35
C:\Program Files\7-Zip\Lang\bg.txt - 9024e85725974e5565ad12f0ad916f0cf1be3472683adbc4926276315f677bd7
C:\Program Files\7-Zip\Lang\br.txt - 98f855b91cbdf4ee471f55212eee24a9cb37bdc0f90729b474b475a77e30488c
C:\Program Files\7-Zip\7zG.exe - bfc601ca44972997a257ef0b811e11bfbae1d27dc895377234f58196c467cd6b
C:\$WinREAgent\Backup\boot.sdi - c9b66549dfa14b0da9214cbb65cafef004e83a609aa2f213bf01f6d1faaf1ec5

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

104.208.16.94
52.123.252.233
4.230.171.124
85.210.196.11
74.179.77.164
52.230.59.222
20.165.94.63
4.150.223.108
74.179.77.204
4.247.188.224
57.155.101.212
135.234.160.245
20.42.73.28
52.110.12.32
52.110.12.15

File paths

X:\windows\system32\sysreset.exe
X:\windows\system32\Dism\SiloedPackageProvider.dll.
X:\windows\system32\Dism\MetaDeployProvider.dll.
C:\Windows
C:\$WINDOWS.~BT\NewOS\Windows
C:\,
C:\inetpub
C:\Windows.old\inetpub,
C:\SkyDriveTemp
C:\Windows.old\SkyDriveTemp,
C:\Recovery
C:\Windows.old\Recovery,
C:\Windows.old\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
C:\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
C:\Windows.old\Recovery]
C:\Recovery\ReAgentOld.xml)
C:\Windows.old]
C:\Reset_SafeToDelete_OverwriteSpaceFile_0.tmp]
C:\Windows\System32\ResetEngine.exe
C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1120_none_c3e
C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1_none_eedfed
X:\SysResetTrace-Tel-Merge.etl,
C:\$WINDOWS.~BT\Sources\Panther\SysResetTrace-Tel-Merge.etl)
C:\Windows.old
C:\.

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report