MALICIOUS — 222.ps1
MALICIOUS — 222.ps1 is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the HUILoader family. 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
83b464a1a5b78aa71e76ebb98278566a1ae787a45b4b1a75995207dbfb6fa84d - SHA-1:
557b969cc6133d4a8537fee0b0872b1108a6973f - MD5:
655954bdf4f30662d421d5d69b20afd4 - ssdeep:
768:g7aMySpJ/C44duocIcSBTf6JwSpVi3Qj4m/I:g7fySpRC44duocIcSBTf6JwqVi3Qj4mA - TLSH:
T1582E418ABA9019CF42CC9049BE8507BE009A5EDD57507BFA0FD2CD91EE4BF0EC452964 - Submitted as: 222.ps1
- File type: script · Size: 31985 bytes
- Verdict: malicious (98/100) · Family: HUILoader
Detections (4 of 53 engines)
- YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Emsisoft (Emergency Kit): CMD:Heur.BZC.PZQ.Boxter.1160.03FA46E0
- Kaspersky (KVRT): HEUR:Trojan.PowerShell.Agent.gen
MITRE ATT&CK
YARA
- Windows_Injection_Api_Combo
Why this verdict
The malicious score of 98/100 is the fusion of 8 weighted signals:
- Process injection API combination (rule
Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90 - Emsisoft (Emergency Kit) flagged CMD:Heur.BZC.PZQ.Boxter.1160.03FA46E0 (rule
CMD:Heur.BZC.PZQ.Boxter.1160.03FA46E0) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.PowerShell.Agent.gen (rule
HEUR:Trojan.PowerShell.Agent.gen) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Obfuscated powershell script: download, shellcode-injection (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule
Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://1846691555.cdn.123clouddisk.com/1846691555/yyds/222.dll - static signal, weight 0.35, confidence 0.60
- inject code into another process (rule
inject code into another process) - capa signal, weight 0.12, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://1846691555.cdn.123clouddisk.com/1846691555/yyds/222.dll
Embedded domains
- section.name
- 1846691555.cdn.123clouddisk.com
More HUILoader samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report