MALICIOUS — 8ad6ca424613dab14a6627fd1deca8b6c57c7f7b858c5344add196dd1e256613

MALICIOUS — 8ad6ca424613dab14a6627fd1deca8b6c57c7f7b858c5344add196dd1e256613 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 7 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 8ad6ca424613dab14a6627fd1deca8b6c57c7f7b858c5344add196dd1e256613
SHA-1: 36bf9be7ff41f5528750f3327c4abcdde31e32d6
MD5: 673eccce4de57b8a7275160fff5d7bad
imphash: b93e8ed458660c96844d697b6acc276e
ssdeep: 6144:kN43gKpDPeVvnAmZ64XMxvQ4x1OpGcm9VQl0lM/oJ4/gupXSS:Y4npK2y8zzkGHVqoq/gKt
TLSH: T1F246E06DC1F277D4CBEB53341F25895C28E04DE8C43F8C2A6245E0A06BE266BE0D2457
Submitted as: 8ad6ca424613dab14a6627fd1deca8b6c57c7f7b858c5344add196dd1e256613
File type: pe · Size: 306351 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Trojan.Agent-1280209
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Urelas!pz
Emsisoft (Emergency Kit): Gen:Heur.Mint.SP.Urelas.1
Kaspersky (KVRT): VHO:Trojan-Dropper.Win32.Plite.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-1280209 (rule Win.Trojan.Agent-1280209) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Urelas!pz (rule Trojan:Win32/Urelas!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Mint.SP.Urelas.1 (rule Gen:Heur.Mint.SP.Urelas.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged VHO:Trojan-Dropper.Win32.Plite.gen (rule VHO:Trojan-Dropper.Win32.Plite.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.text, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

22346 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - 7148a1bdcc91b54a7eec70353fcc7053f73a1befcc9472aa64a64dabb6645fec
C:\Users\analyst\AppData\Local\Temp\cupuv.exe - 74228f8463c1ef0208a86e117d13824752b20631e4e6eee7b9ce2a1c29756f20
C:\Users\analyst\AppData\Local\Temp\bebub.exe - 9c596981bad9ea9d3cdf05c91eec17144c5cf7babc728eeadce5393e7e2a1db7
7466102d285a78cddd0011ac1a5e88614c5f8157e495074aac210f6f717d9f52 - 7466102d285a78cddd0011ac1a5e88614c5f8157e495074aac210f6f717d9f52

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

4.150.223.109
52.123.252.242
4.230.171.124
85.210.193.152
52.230.59.222
20.165.94.54
104.18.33.89
135.232.92.137
4.150.223.102
20.42.73.31
74.178.76.128
218.54.31.226
1.234.83.146
52.110.12.28
52.110.12.14
218.54.31.165
133.242.129.155
135.233.45.221
72.154.7.97
52.148.114.188
52.110.12.33

File paths

c:\work\Update_2005_rep\bin\release\MkRegister.pdb

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report