MALICIOUS — 8a5c793dfcdb407b439d00ea9688b620ea6976c4871112293d50a58a3572bf73

MALICIOUS — 8a5c793dfcdb407b439d00ea9688b620ea6976c4871112293d50a58a3572bf73 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 7 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 8a5c793dfcdb407b439d00ea9688b620ea6976c4871112293d50a58a3572bf73
SHA-1: 22d88c4eeabed621575923ddd05b805f50e64f81
MD5: 6f4c4a9a8806ad76cdc8491fc08f46fc
imphash: 5144a995e58e9a1dec8b8e0e5ed55aec
ssdeep: 49152:9b8ex39aii89IRb8ex39aii89IRb8ex39aii89IRb8ex39aii89IRb8ex39aii8:9b7aeab7aeab7aeab7aeab7aep
TLSH: T1B8619EA585226602FC3DBFE84D41154FD5F26B3F6F6D482A915340E42AEB2370AE503E
Submitted as: 8a5c793dfcdb407b439d00ea9688b620ea6976c4871112293d50a58a3572bf73
File type: pe · Size: 3895296 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (7 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Generic-9907165-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Pidgeon.A
Emsisoft (Emergency Kit): Win32.Prepender.Gen.1
Trellix Stinger (McAfee): Flyagent.d
Kaspersky (KVRT): Virus.Win32.Agent.ev

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9907165-0 (rule Win.Trojan.Generic-9907165-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Pidgeon.A (rule Virus:Win32/Pidgeon.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Prepender.Gen.1 (rule Win32.Prepender.Gen.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Flyagent.d (rule Flyagent.d) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Agent.ev (rule Virus.Win32.Agent.ev) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
2 behavioral detection(s) across 2 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.43, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.eyuyan.com - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 22 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

68983 behavior events · 2 ATT&CK techniques · 29 dropped files.

Dropped files

C:\Program Files\7-Zip\Uninstall.exe.exe - a4e69189c0812f50e5a710cbd254f8aedd4b8366624692ab2706031bf45e3735
C:\Users\analyst\AppData\Local\Temp\tsk_b8e383ab87284501.exe.exe - 4d0bd9fd5778f4853fb054d9880acb2f76f511b57b19fe283b963d92b69ac9ea
C:\Program Files\7-Zip\7zG.exe.ico - 8cad493433ec34a34ca6f4fd49655aaf7cbb4337752743804db83ea6c050d1fe
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe - e29bbc8cae1354ca8cd55a293c7711f57d43263f54ead45b273ac7963891dabf
C:\Program Files\7-Zip\Uninstall.exe.ico - ea0420b60b078a22fdcfd40d86d589793baa2e0327b37dcdcc5399aac4037d4e
C:\Program Files\7-Zip\Uninstall.exe - 884412a70a30f6fa5ea19fe9841ca2be16b26ba4723a80c11e07aeacee7f1fe4
C:\Users\analyst\AppData\Local\Temp\tsk_b8e383ab87284501.exe.exe.exe.exe.exe - 7a09c1d5a69552a764660832723e84a90d0106145746e3f17f4b16cc962ecdb1
748a0462230c520bdc20d134439f1e333b05cafa2976c9a728e6d75776f8ffa7 - 748a0462230c520bdc20d134439f1e333b05cafa2976c9a728e6d75776f8ffa7
2659b63ecb257ebd01706b92fb47f6b03051c4183f023233b4114eef10708331 - 2659b63ecb257ebd01706b92fb47f6b03051c4183f023233b4114eef10708331
C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe - 341f8764e728d11dee58c3b6ac3a59e2f220dca78e360341fa38c3f6aa7aebaa
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe - 0f749a476316d37cbf91a44c6058a83148f32901557d9b9e003295881a83c7ec
C:\Program Files\7-Zip\7zG.exe.exe - 90ef046e0bdc7c42141c5dca0d2a4a6609ce4a6195dfcae5e90cd1a70f72e242
C:\Program Files\7-Zip\7zFM.exe - 140fb23f3dee43f5627fd1af256b90ab1f988901517ab7a92cab1c3d091e93d7
19ae4dc6481f738d164b59daa58659ddc4419911089464415840e7ab31e4bf4b - 19ae4dc6481f738d164b59daa58659ddc4419911089464415840e7ab31e4bf4b
C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe.exe - aeaf963801cdae1843ce4eda0f8f7bceef83120e507e68ebf55d623956f5f149

Embedded URLs

http://www.eyuyan.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.eyuyan.com
wtqq.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.103
20.247.184.142
4.230.171.124
172.215.188.225
135.232.92.97
74.178.240.61
20.50.73.5
172.64.154.167
92.223.78.30
52.110.12.24
52.110.12.44
20.42.73.24
13.69.239.69
72.153.5.137
52.148.114.188
52.110.12.4
52.110.12.40

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report