MALICIOUS — 8a5552729da4316adb0bea29465fb863e94a8c42263a36691bd415689c9f7a3b

MALICIOUS — 8a5552729da4316adb0bea29465fb863e94a8c42263a36691bd415689c9f7a3b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upantix family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 8a5552729da4316adb0bea29465fb863e94a8c42263a36691bd415689c9f7a3b
SHA-1: 35a606832fc94412d9ef8d5570db6bc5ae9cc400
MD5: c836a9c9b1eb7fef3908ff002725827c
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 6144:5dkkkkkku21Fdkkkkkku21W14OdkkkkkkoQc0bVdkkkkkku21Fdkkkkkku21W14E:5w23w2Q14O2Q7bVw23w2Q14O2Q7bCD6
TLSH: T12F4FE140367A788CDB349F605524998DA12552C5847C3EEA9B03071D3CB78BBB9E8FB1
Submitted as: 8a5552729da4316adb0bea29465fb863e94a8c42263a36691bd415689c9f7a3b
File type: pe · Size: 729746 bytes
Verdict: malicious (99/100) · Family: Upantix

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Upantix.GM!MTB (rule Trojan:Win32/Upantix.GM!MTB) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Packed.Win32.Upantix.gen (rule HEUR:Packed.Win32.Upantix.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

281 behavior events · 0 ATT&CK techniques · 10 dropped files.

Dropped files

C:\Windows\win32dc\Silent Hill 4 + patch.exe - b887edb1c360f671f19380a184955ef2a90ca5d808118ad8286d25f7660936c1
C:\Windows\win32dc\DAoC(cdfix).exe - a573aeb0c8ba046643ad2ad3decdf53d7be6ab3b63065c90681fadf75895714e
C:\Windows\win32dc\Quake3_codes.exe - ad3e418009db8fee5d9715830545b3e1b6b21e8d39b7e84855107030af593696
C:\Windows\win32dc\UT2004 + cheat.exe - 87f95e6939b26000857b70dccac08e5a4fbcb9119b9eddb32c5629dc576dc2fe
C:\Windows\win32dc\BattleField 1942 nocd.exe - 5218d7e117edcecde09e45329c033c3364bb3fadb25f390eec2478e16343ef03
C:\Windows\win32dc\FlatOut_crack.exe - 681f44693b4a93a8c2b227e46213abbed51dd3245c6b069abd7189f4312f61ee
C:\Windows\win32dc\DAoC hack.exe - 1eb51b7edc152dd42cf94f1f0947e72518fdf1f4e1c29019f7e5c01e0a84f4c2
C:\Windows\win32dc\Doom 3 + trainer.exe - 3d54b192035c1f4dc41cc46bbdfe62e7ea7ace80a57505d06da13914f747693d
C:\Windows\win32dc\FlatOut patch.exe - e3d477b3ccc6b65b7d49bf0b61be3731cb67dbd9993ad1db15a90dae26b9cbe5
C:\Windows\win32dc\Silent Hill 4 + cheat.exe - 7236afb5d6d0d4f568b2cdd7a00fc0c930871cb008283586ae66584c7cb2315c

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

aefd.nelreports.net

Embedded IP addresses

4.150.223.110
52.123.252.192
4.230.171.124
172.215.188.225
20.247.184.142
74.178.240.51
20.42.73.24
74.179.77.204
74.178.76.128
4.150.223.96
52.182.143.212
40.84.97.4
72.153.5.61
92.223.78.30
52.148.114.188
52.110.12.56
52.110.12.1

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report