MALICIOUS — 8602e3ede1cb4b550c9940b61116214d1ef37e045553033eda854a19b5631846

MALICIOUS — 8602e3ede1cb4b550c9940b61116214d1ef37e045553033eda854a19b5631846 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 8602e3ede1cb4b550c9940b61116214d1ef37e045553033eda854a19b5631846
SHA-1: 7c24d1f5fb22100ede05ff7b3a41171337ce12b0
MD5: 597d66ec05756420f1d275992ad2d36d
imphash: f5e2fae08fb1c8fba965c988eb10e880
ssdeep: 12288:8uPUTLYcAaUMhUhLupXshh1PEd5hOovNn8NjMccSTHM/:8uPmLDUMihIXCE5ccos/
TLSH: T11D52D07E172BB797C637D2340E412F6D0426BCA6607E144CD3AB842DB3E7C6B1601A69
Submitted as: 8602e3ede1cb4b550c9940b61116214d1ef37e045553033eda854a19b5631846
File type: pe · Size: 971260 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (6 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Generickdz-9832066-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Phobos.154
Kaspersky (KVRT): HEUR:Trojan.Win32.Scar.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Malware.Generickdz-9832066-0 (rule Win.Malware.Generickdz-9832066-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Vindor!pz (rule Trojan:Win32/Vindor!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Ransom.Phobos.154 (rule Gen:Variant.Ransom.Phobos.154) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Scar.gen (rule HEUR:Trojan.Win32.Scar.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://http.proxy.icq.com/hello - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 8 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

92095 behavior events · 2 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Python3\Lib\site-packages\pip\_vendor\distlib\w64.exe - e43d1a6cad399c76025ac79343a580142749a1add79bd186b2af9cbf9db946ca
C:\Python3\Lib\site-packages\pip\_vendor\distlib\t64.exe - 0b004754b4d866f96cbda143577cd832c8fcac519545defe95aef4a363a0adae
C:\Users\analyst\AppData\Local\Temp\NSPTR - 951dee16f40fa1f1331f68aac78fbd861b90047a2b4f790852abec475b59218d
C:\Python3\python.exe - a48a0670fa0ae05fb0520811f53e6587ea5a7f41262a3afdf8bc6a3af1f21e56
C:\Python3\Lib\venv\scripts\nt\python.exe - 4b386cb093c815832e553f5f6f1da7c9b045abbf7d59b5a701bdd4b87283cbf4
C:\Python3\Lib\venv\scripts\nt\pythonw.exe - 8ee0aff0c8030cd2bcb130517ad64499d778a4ccf7013c2f55a1bc37c90dec91
C:\Python3\Lib\site-packages\pip\_vendor\distlib\t32.exe - f068f99ff87623bd000f3dcec4e3ed0589aa900d68ecce0263bdbef0ec5e3cfc
C:\Users\Public\Microsoft Build\Isass.exe - 019f21bfab96dc4721d5fcf8a0833208c0331a38e5ca2209878ef14f33e2c292
C:\Users\analyst\AppData\Local\Temp\YCEJJ - 27c6328f3592e9d34da7fbd341db58863ebc60e8a39eb9a1deea9b8d593a1ed6
C:\Python3\Lib\site-packages\pip\_vendor\distlib\w32.exe - ef952d16ca624a49f59f43bdcfd4bfad29e0b1ddf863b822a464d0d29e0b2569
C:\Users\analyst\AppData\Local\Temp\TGMUX - a27e4fe4140797d50c19ba963d4076400fce5fea3faffe184b984da930378c9f

Embedded URLs

http://http.proxy.icq.com/hello
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

http.proxy.icq.com
login.icq.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

0.0.0.1
13.89.179.15
52.123.252.238
4.230.171.124
172.215.188.225
104.18.33.89
4.144.132.223
20.42.73.30
74.179.77.164
74.178.240.61
92.223.78.30
20.42.72.131
20.42.179.192
172.66.2.5
52.110.12.26
52.110.12.28
72.154.7.99
52.148.114.188
52.110.12.38
52.110.12.19

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report