MALICIOUS — 7f30fa42d00efe55105d38e9d6e2ec0e1d9ea4897eb7dbc5022e6dbf30f69ce3

MALICIOUS — 7f30fa42d00efe55105d38e9d6e2ec0e1d9ea4897eb7dbc5022e6dbf30f69ce3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the HUILoader family. 2 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 7f30fa42d00efe55105d38e9d6e2ec0e1d9ea4897eb7dbc5022e6dbf30f69ce3
SHA-1: b7aec373d780b7fdbb8cc25bf156bee37ea2b90e
MD5: 26197cf28d3a85e74d495a8ccb57dc7f
imphash: d289668dfc2163a8d7ebe8a066b87241
ssdeep: 98304:JF6O4xe3rNa+KCm3gSPmR3/naEgMd/mv8RJkLXM:f4iWz0P2zv+J6XM
TLSH: T1DB61337696D0E2ECF572E6005C5E4A1F507692F70276E0C88DB3C3AD9DE710BA908276
Submitted as: 7f30fa42d00efe55105d38e9d6e2ec0e1d9ea4897eb7dbc5022e6dbf30f69ce3
File type: pe · Size: 3984157 bytes
Verdict: malicious (94/100) · Family: HUILoader

Detections (2 of 56 engines)

YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Kaspersky (KVRT): HEUR:Trojan.MSIL.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 94/100 is the fusion of 8 weighted signals:

Kaspersky (KVRT) flagged HEUR:Trojan.MSIL.Agent.gen (rule HEUR:Trojan.MSIL.Agent.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

13924 behavior events · 2 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\Appointees.exe - 13ff63297c97c2e0b2a56c92e272333a7a166a0aed59b0ac58dd60de699eafbe
a87464a11665785357fc82b2c57701f87009f2572029e7dd68d4976207e22772 - a87464a11665785357fc82b2c57701f87009f2572029e7dd68d4976207e22772
945d17523d7e5c6596f7b11dbe9113dd08d8f204d9298530de51fbf244892fce - 945d17523d7e5c6596f7b11dbe9113dd08d8f204d9298530de51fbf244892fce
a0b6533e20890508d595c8bbda0914b560a68b95eb64238c7e2cff53b91aa1f3 - a0b6533e20890508d595c8bbda0914b560a68b95eb64238c7e2cff53b91aa1f3
5b6acc559a3a558e9d792d1237560f687bef134702dfb5317ea38a69b194a4a9 - 5b6acc559a3a558e9d792d1237560f687bef134702dfb5317ea38a69b194a4a9

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

schemas.microsoft.com
j.jp
cd.mx
o.kr

Embedded IP addresses

4.150.223.114
4.230.171.124
172.215.188.225
20.247.184.197
20.165.94.54
20.42.73.28
74.178.240.61
74.178.76.128
48.211.4.16
135.234.160.244
52.110.12.52
52.110.12.4
172.178.240.161
4.150.223.111
20.42.65.93
72.145.35.98
52.148.114.188
52.110.12.30
52.110.12.42

File paths

d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
B:\R1
K:\ggn

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report