MALICIOUS — 8730202dc2298ff83430bd251ab886962d822909c95b86c8966b1c7f0c2b6c36

MALICIOUS — 8730202dc2298ff83430bd251ab886962d822909c95b86c8966b1c7f0c2b6c36 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 8730202dc2298ff83430bd251ab886962d822909c95b86c8966b1c7f0c2b6c36
SHA-1: 40277b78fd9210e660ad96380cb7b65eab95bf11
MD5: 5c3eb5fcb64ef2d0c27bdc6760b9a7e8
imphash: f5e2fae08fb1c8fba965c988eb10e880
ssdeep: 24576:8uPmLDUMihIXCE5tpJE4VDd+ZBPXgylVMSRk1LYoNMsZUsB5EOZ:8u+LIIX71JE4VBaBPXgyLg1kousZV
TLSH: T19456E07A02FB7BC7C6F3C7884504DE6C0062A139513B1089E3A384AF7BE395B2585675
Submitted as: 8730202dc2298ff83430bd251ab886962d822909c95b86c8966b1c7f0c2b6c36
File type: pe · Size: 1458890 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (6 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Generickdz-9832066-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Phobos.154
Kaspersky (KVRT): HEUR:Trojan.Win32.Scar.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Malware.Generickdz-9832066-0 (rule Win.Malware.Generickdz-9832066-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Vindor!pz (rule Trojan:Win32/Vindor!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Ransom.Phobos.154 (rule Gen:Variant.Ransom.Phobos.154) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Scar.gen (rule HEUR:Trojan.Win32.Scar.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://http.proxy.icq.com/hello - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 7 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

90495 behavior events · 2 ATT&CK techniques · 10 dropped files.

Dropped files

C:\Python3\Lib\site-packages\pip\_vendor\distlib\t64.exe - b8fd0bbacfe8b43ded73c41b3f1a156b74bec4e61b99ab3938d6d93900c927fb
C:\Python3\Lib\venv\scripts\nt\python.exe - b43af0d54ff937d0095edc9848b0b577fe732605160e0429e345d6424c17b643
C:\Users\analyst\AppData\Local\Temp\JMHUY - 951dee16f40fa1f1331f68aac78fbd861b90047a2b4f790852abec475b59218d
C:\Python3\python.exe - b883e5620e0431a38877141589c88d6b9ba0863eaaf00c9d47eef26d14a5ff6c
C:\Python3\Lib\site-packages\pip\_vendor\distlib\t32.exe - 1a302d4bc333f425510743c1cbc11da0f0f203b9af56b548dfe1c3b76e9a641e
C:\Python3\Lib\site-packages\pip\_vendor\distlib\w64.exe - b6f6705396ab3aa824499a48986e3252236d930d3a817c7ff65e42043f12d5db
C:\Python3\Lib\site-packages\pip\_vendor\distlib\w32.exe - 700a810e201e3cb8e7f8001c643094dc62034d3857644e873905f118f43e1c02
C:\Users\analyst\AppData\Local\Temp\OIHLY - 27c6328f3592e9d34da7fbd341db58863ebc60e8a39eb9a1deea9b8d593a1ed6
C:\Python3\Lib\venv\scripts\nt\pythonw.exe - d266819c6b39fe0b92bd3269251a8c61796bb7e001253d0c1dacd34a5217ffeb
C:\Users\analyst\AppData\Local\Temp\RERRR - a27e4fe4140797d50c19ba963d4076400fce5fea3faffe184b984da930378c9f

Embedded URLs

http://http.proxy.icq.com/hello
http://crl.verisign.com/tss-ca.crl0
http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0O
http://office.microsoft.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

http.proxy.icq.com
login.icq.com
crl.verisign.com
crl.microsoft.com
www.microsoft.com
office.microsoft.com
aefd.nelreports.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

0.0.0.1
20.42.73.28
52.123.252.213
4.144.132.223
57.155.104.224
4.230.171.124
74.179.77.204
135.232.92.97
20.42.65.94
104.18.33.89
4.150.223.101
4.247.188.233
4.150.223.96
52.148.114.188
72.153.5.137
52.110.12.14
52.110.12.52

File paths

R:\Sg
X:\:`:d:h:l:p:t:x:
V:\:a:g:r:x:

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report