MALICIOUS — 7a867549098dcc62f8eae8a5eb4a6e44dbbc5ac9a12bb24b729ef8d1cfcb46a4

MALICIOUS — 7a867549098dcc62f8eae8a5eb4a6e44dbbc5ac9a12bb24b729ef8d1cfcb46a4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upantix family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 7a867549098dcc62f8eae8a5eb4a6e44dbbc5ac9a12bb24b729ef8d1cfcb46a4
SHA-1: 39299e74391a5d5ff09197b7eb93673263fc7fb9
MD5: acd57385a5f4dcdd4c2f3876afd518b3
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 12288:5wawSwaw1wawSwawz6FwawSwaw1wawSwawz6kVwawSwaw1wawSwawz6FwawSwaw/:k
TLSH: T10760D000327A399CD7709F605524598DA22552C1897D3EEA9B03072D3CB78BBB9E8F71
Submitted as: 7a867549098dcc62f8eae8a5eb4a6e44dbbc5ac9a12bb24b729ef8d1cfcb46a4
File type: pe · Size: 3489796 bytes
Verdict: malicious (99/100) · Family: Upantix

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Upantix.GM!MTB (rule Trojan:Win32/Upantix.GM!MTB) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Packed.Win32.Upantix.gen (rule HEUR:Packed.Win32.Upantix.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 1 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 6 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

241 behavior events · 0 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Windows\win32dc\UT2004(trainer).exe - 316b27024c51d0d2df747e2cb09c8ff910483af3ad7716e935179d12d21f3ffe
C:\Windows\win32dc\BattleField 1942(cdfix).exe - ed72a558fc38de66e32d704491c2d3c359c3996cd7a7391dc3d92334ddb71a73
C:\Windows\win32dc\Silent Hill 4 fix.exe - 48e5cc3e3b41f80916d94710beadcab5da3a5bc2c49bc8c40ff26b9401238647
C:\Windows\win32dc\Quake3 + nocd.exe - 8e1574a8cf59bb1c10f5102f361b43f10bdb1092691fbed52573e80a751af5d3
C:\Windows\win32dc\UT2004 fix.exe - 0c8ebbed5ad5dee3e34ad0473bf9de369761b33ae70afa035293f0e19a41a5a4
C:\Windows\win32dc\DAoC_nocd.exe - 0ed291c8592b0d644d1cedad1746012e169bf732d311a2e53a8a829313e8246d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

13.69.109.130
52.123.252.202
4.230.171.124
172.215.188.232
20.247.184.142
74.179.77.164
74.179.77.204
20.42.73.26
104.208.16.94
52.110.12.22
20.42.73.28
52.168.117.174
72.154.7.100
52.148.114.188
52.110.12.31
52.110.12.4

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report