MALICIOUS — 8daa2640f527caca63a76681e0affe3fc43b62d837aef532caf1ee408e49edbe

MALICIOUS — 8daa2640f527caca63a76681e0affe3fc43b62d837aef532caf1ee408e49edbe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upantix family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 8daa2640f527caca63a76681e0affe3fc43b62d837aef532caf1ee408e49edbe
SHA-1: 3bcb03bea2d80db1cc74d59f63c2fd7a7ff0fef3
MD5: de083b9e920d9b36543845a35caf9723
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 12288:5wh+pAMDhwh+pAMD9EFgMwh+pAMDhwh+pAMD9EFg6BjN:NAMRAMZAAMRAMZaN
TLSH: T1824EF1043675799CD774AF611550484CB22152C2893C2EDA9F030B693CBB8BBB9ECFA5
Submitted as: 8daa2640f527caca63a76681e0affe3fc43b62d837aef532caf1ee408e49edbe
File type: pe · Size: 645121 bytes
Verdict: malicious (99/100) · Family: Upantix

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Upantix.GM!MTB (rule Trojan:Win32/Upantix.GM!MTB) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Packed.Win32.Upantix.gen (rule HEUR:Packed.Win32.Upantix.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 2 external host(s) and 15 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 6 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

176 behavior events · 0 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Windows\win32dc\Sims 2_cheat.exe - 7969eed8ceb438c4fdceff667512f3f7b0238e97e42f63eaafbec1090a16b584
C:\Windows\win32dc\Silent Hill 4_nocd.exe - 6802d9d1ea630655432a304f611bc17beee15fca4d1a259df3cc5afe9ae1b7f0
C:\Windows\win32dc\Sims 2 + fix.exe - 70ab4653afc86b3ab88188a65b5f82c2199750c9e28a2c5fd640d617c0e0dca2
C:\Windows\win32dc\UT2004 fix.exe - d251a9cd2e9578080a3d1844c48733582b2f4fb36ff1734eb2017588f5f0ca13
C:\Windows\win32dc\BattleField 1942_serial.exe - 55b1b12b8622ed574f24412c0a81533d64d7e37c5b94240f1dd96158b3cb5761
C:\Windows\win32dc\Half-Life 2 + cheat.exe - 2acfbd9b1acf9800ff82eb4fbd13202aa66d3e4ab60f21f7852018ee30e1e4bd

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.112.66
4.230.171.124
52.230.59.222
104.18.33.89
52.110.12.21
52.110.12.48
57.154.63.210
57.155.104.224
72.153.5.137
52.110.12.53
52.110.12.10
52.148.114.188

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report