MALICIOUS — 8da0406abfdb8ea05727aaf1a675ec6bc9d76f7854ce94707788b2c2edc5c624

MALICIOUS — 8da0406abfdb8ea05727aaf1a675ec6bc9d76f7854ce94707788b2c2edc5c624 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Upantix family. 6 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 8da0406abfdb8ea05727aaf1a675ec6bc9d76f7854ce94707788b2c2edc5c624
SHA-1: 139f2d1ea19e1b439bbef4a259d1a87786263b7c
MD5: b0c4bfd1807208a74b12b35125f58922
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 6144:5dkkkkkku21Fdkkkkkku21W14OdkkkkkkoQcGpdkkkkkku21FdkkkkkkySU0/Q:5w23w2Q14O2QTw23Ey/Q
TLSH: T1C84CE040327A799CCB345F601514998DA12552C5887D3EEA9B03072D3CB78BBB9ECFA1
Submitted as: 8da0406abfdb8ea05727aaf1a675ec6bc9d76f7854ce94707788b2c2edc5c624
File type: pe · Size: 548043 bytes
Verdict: malicious (100/100) · Family: Upantix

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Upantix.GM!MTB (rule Trojan:Win32/Upantix.GM!MTB) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Packed.Win32.Upantix.gen (rule HEUR:Packed.Win32.Upantix.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
1 behavioral detection(s) across 1 rule(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 8 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

1346 behavior events · 0 ATT&CK techniques · 8 dropped files.

Dropped files

C:\Windows\win32dc\Counter-Strike_crack.exe - e6918c9fc7f960e265d7c5c3683f83c8942ed9a2d0085e4e0bf16632eb524274
C:\Windows\win32dc\DAoC + crack.exe - 5b75dac6f1fba94ba5f1ff3c7aef3165ce32d15b1a13275326f2b4ac8bfaf926
C:\Windows\win32dc\FlatOut_nocd.exe - 73a93f8b091fa11a66d70b7dad7aa68f990080b5b9f4fbb1892ae37c71d998c5
C:\Windows\win32dc\DAoC(trainer).exe - 287470e33042001d5f91b9c818e31a45474d98a47771af48ff8a4a2026a66baf
C:\Windows\win32dc\DAoC_serial.exe - 78798b5a62cdcace152d870571c1bc60db1899b9da8ddc81b2d4486e2c5739a1
C:\Windows\win32dc\DAoC(codes).exe - f3042f6c4af188bb8f5d1bc638ca10934a46a00a64cbf404291d24e14c8c2937
C:\Windows\win32dc\Half-Life 2(nocd).exe - 8661b028fcd60cd02859e5f4113ea8ffb9b48de082013726bd645b5e61124123
C:\Windows\win32dc\Half-Life 2 codes.exe - 2388bd7b79ad46b06093c6e8b078d083160b9cf6042362bb96cf6d29704dd6f1

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

us.undernet.org
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.99
4.144.132.223
4.230.171.124
172.64.154.167
186.233.185.155
40.84.85.40
52.110.12.15
52.110.12.54
52.110.12.56
72.154.7.107
52.148.114.188

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report