MALICIOUS — FlatOut + cdfix.exe

MALICIOUS — FlatOut + cdfix.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 82659746e86ba73df9b82d97fa40055d6bb4a3684e1b7cac17455bee4e189f29
SHA-1: 5c2c10412455353c0a003460031e02c076e8ca75
MD5: 01f758a95f6898275204788d784353ca
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 12288:5wawSwaw1wawSwaw9zJwawSwaw1wawSwaw9zswawSwaw1wawSwaw9zJwawSwaw1i:n6J
TLSH: T11560D100327A399CD7709F605524598DA22552C1897D3EEA9B03072D3CB78BBB9E8F71
Submitted as: FlatOut + cdfix.exe
File type: pe · Size: 3533711 bytes
Verdict: malicious (98/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 33 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 8 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

619 behavior events · 0 ATT&CK techniques · 8 dropped files.

Dropped files

C:\Windows\win32dc\Half-Life 2 crack.exe - 19437379a7b35dd5cbb4fc77e9fa8d69715ff562fda9a8ce6d9a76cda49341a3
C:\Windows\win32dc\DAoC_hack.exe - 5be2f4612da2c10f9cae174c3d736577b6e1bd17e02bc01fcdea79f5f651343e
C:\Windows\win32dc\FlatOut patch.exe - 7d94faa7b1d25693759872c697a140c125103a0877c6831928857779c19e67eb
C:\Windows\win32dc\Counter-Strike(fix).exe - 7ce549c5ef94afe22f46d404a50d54f1b3abaeb79dcf94815bc22907750c221c
C:\Windows\win32dc\BattleField 1942 + crack.exe - 57b59eb6dd1ede0a8a63eefba26664033d0cb2acf7fc3d2d45bfa4185174ed52
C:\Windows\win32dc\UT2004 + cheat.exe - fe3092ea7323e3d28f229a8512edac87d5f89a42b3bbb14ea6590ee01cf61d65
C:\Windows\win32dc\Doom 3 cdfix.exe - 30715815fc523820fe1870764973b3b27ff5f9d78e93d3616c74bcec444602a2
C:\Windows\win32dc\Sims 2_codes.exe - 025f785a5aa0ab4eede3cc0bb7eea21dc5c9913aadaca059944a29faf5321a3e

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787673759&P2=404&P3=2&P4=cu6v6lBVe07bypZO9jI1dim90zIJA%2bNb1cN5WooS1JG2bv67kNXbAwNdVuXXHPKC3%2bgFaTfgPmhOondWxKRGrA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787673817&P2=404&P3=2&P4=RgllCV44RrOp6bpsf2CNpmPNCa0RYptnEWZLnzyk%2fh62E0sJyR6XpyDc6%2f%2bmMHZCur9v75jLikajPbF3GkaNSA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

us.undernet.org

Embedded IP addresses

142.250.195.142
4.150.223.107
52.123.252.220
4.144.132.114
20.42.179.204
4.230.171.124
20.165.94.63
135.232.92.97
4.150.223.104
52.123.252.198
74.178.240.61
52.123.129.14
40.99.133.242
20.112.250.133
162.159.142.9
20.184.175.15
142.250.195.238
203.26.79.13
135.234.160.245
92.223.78.30
20.165.94.46
172.83.156.122
52.148.114.188
20.184.175.21
20.42.65.85

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report