MALICIOUS — 8dc3950fa4aefd88d65d255830a251e95377e57d4aa55d799632469c7fdeb784

MALICIOUS — 8dc3950fa4aefd88d65d255830a251e95377e57d4aa55d799632469c7fdeb784 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 10 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 8dc3950fa4aefd88d65d255830a251e95377e57d4aa55d799632469c7fdeb784
SHA-1: 4537fde8327b334c5addac124020c6a3de209b42
MD5: 3edf3d88b94777f79bd12b8f229a8f1b
imphash: 3aaf46fe417dde7985c17bf9311368bf
ssdeep: 49152:qZIV8G9HN52lhqXChFciXZbDsD49XpzK4Hy0kBkzCym70ZAW2ROQcverO04T2+Q9:AeT6lJR95axyOP4TsyVPKAJ7E
TLSH: T1AB669FC6972B5212D2BBDD547C14B9ACC421B0AC197CF78CBB43C5764096C3BEEA502A
Submitted as: 8dc3950fa4aefd88d65d255830a251e95377e57d4aa55d799632469c7fdeb784
File type: pe · Size: 6668037 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (10 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Generic-7135733-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
YARA: Yara-Rules community: YR_AntiDebug_Checks
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Downloader.CH!MTB
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Amnesia.1
Trellix Stinger (McAfee): Packed-KS!3EDF3D88B947
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 22 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-7135733-0 (rule Win.Trojan.Generic-7135733-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Downloader.CH!MTB (rule Trojan:Win32/Downloader.CH!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Ransom.Amnesia.1 (rule Gen:Variant.Ransom.Amnesia.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Packed-KS!3EDF3D88B947 (rule Packed-KS!3EDF3D88B947) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Packed.Win32.Upantix.gen (rule HEUR:Packed.Win32.Upantix.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70
Contacted 2 external host(s) and 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://hoohoo.ncsa.uiuc.edu/docs/tutorials/imagemapping.html, https://www.oo-software.com/, https://go.oo-software.com/91340 - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

51628 behavior events · 3 ATT&CK techniques · 86 dropped files.

Dropped files

C:\Program Files\7-Zip\Lang\ro.txt - 4fd993dbae9606c062dc3511292274631335956a016b74b3061bab55f7d9c736
C:\Program Files\7-Zip\Lang\is.txt - dc61090369e1269a68c75e472d863aaf42207f702b3d3e12ca48d2852e1478e3
C:\Program Files\7-Zip\Lang\nn.txt - db540e1a6b8ffff2497f9c1a63f85cb5f345f8cba767f05377c0365abaf7b7d4
C:\Program Files\7-Zip\Lang\ku-ckb.txt - b8b7db8c139b19d414cef35ae96d854d5a8364c32b0c3fdc4cac331b5af44c16
C:\Program Files\7-Zip\Lang\lv.txt - 533f9ff016e7bb36216665cca1065139a35d8da71651678814415ff457a9be7d
C:\Program Files\7-Zip\Lang\el.txt - 2dd2130f94d31262b12680c080c96b38ad55c1007f9e610ec8473d4bb13d2908
C:\Program Files\7-Zip\Lang\gu.txt - c6e54e2a93b821bc974209cd7e2d10e9fbc4ff07d238ae84f552e4ade271702c
C:\Program Files\7-Zip\Lang\ms.txt - c88bc7ea0c20769847a0403e188e273a0897d1c77dd72cc4b45471fc67e0d5e1
C:\Program Files\7-Zip\Lang\fi.txt - 12cc4a2cef76045e07dafc7aec7cf6f16a646c0bb80873ec89a5ae0b4844443b
C:\Program Files\7-Zip\Lang\sw.txt - 9fed3c0b4e67673bc1d8bbd67d1f6651fade030f98d12173c3564f2c492a67f8
C:\Program Files\7-Zip\Lang\kab.txt - f249930089c374eab59078cf16b8652d443cf2a47485d737ae5a9fca2957d6b9
C:\Program Files\7-Zip\Lang\hi.txt - 5f79ae167a917860f95f73e5ed007fe250f30af794bcfce17941f9ef87d22a05
C:\Program Files\7-Zip\Lang\ca.txt - da4df6490c7bc8afd804509f696f9afa6f709b7a327044e2781fa6c95770b239
C:\Program Files\7-Zip\Lang\eu.txt - a1c9d46b0639878951538f531bba69aeddd61e6ad5229e3bf9c458196851c7d8
C:\Program Files\7-Zip\Lang\fa.txt - 657f2aceb60d557f907603568b0096f9d94143ff5a624262bbfeb019d45d06d7

Embedded URLs

http://go.microsoft.com/fwlink/?LinkId=9996
http://crl.verisign.com/tss-ca.crl0
https://www.verisign.com/rpa
https://www.verisign.com/rpa01
http://crl.verisign.com/pca3.crl0
http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0D
https://www.verisign.com/rpa0
http://office.microsoft.com
http://ocsp.verisign.com/ocsp/status0
http://hoohoo.ncsa.uiuc.edu/docs/tutorials/imagemapping.html
https://www.verisign.com/cps0
http://logo.verisign.com/vslogo.gif04
http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
https://www.verisign.com/cps0*
http://crl.verisign.com/pca3-g5.crl04
http://schemas.microsoft.com/winfx/2006/xaml
https://www.oo-software.com/
https://go.oo-software.com/91340
https://www.oo-software.com/ooshutup10/eula
https://www.oo-software.com/en/shutup10
https://www.oo-software.com/de/shutup10
https://www.oo-software.com
http://www.w3.org/2001/XMLSchema-instance
http://crl.thawte.com/ThawteTimestampingCA.crl0

Embedded domains

go.microsoft.com
crl.verisign.com
www.verisign.com
crl.microsoft.com
office.microsoft.com
ocsp.verisign.com
hoohoo.ncsa.uiuc.edu
logo.verisign.com
csc3-2010-crl.verisign.com
csc3-2010-aia.verisign.com
schemas.microsoft.com
www.oo-software.com
go.oo-software.com
oo-software.com
outlook.com
www.w3.org
crl.thawte.com
ts-aia.ws.symantec.com
ts-crl.ws.symantec.com
sv.symcb.com
d.symcb.com
www.symauth.com
s1.symcb.com
www.entrust.net
aia.entrust.net

Embedded IP addresses

3.0.1.0
3.0.1.3
2.1.4.0
9.2.0.124
6.0.6.0
40.79.150.121
52.123.252.219
4.230.171.124
20.42.179.192
74.179.77.164
4.150.223.107
74.178.240.61
20.247.184.197
4.150.223.100
52.110.12.3
52.110.12.40
135.234.160.246
57.154.63.210
72.153.5.129
52.148.114.188
52.110.12.16
52.110.12.47

Registry keys

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
HKCU\Software
HKCU\Software\Policies
HKLM\Software
HKLM\Software\Policies
HKCU\\Software\\O&O\\O&O

File paths

P:\server\source\mapprogs\winnt\imagemap.pdb
C:\Development\VBProj\QDiff\VBGraphics.tlb
C:\WINDOWS\System32\MSVBVM60.DLL\3
C:\Program
e:\jenkins-slave\workspace\ultibranch_1.7.1408b-NewFeatures\OOSoftware.ShutUp10.WinApp\obj\Release\OOSU10.pdb
C:\btvsts\3621\private\softgrid\shared\include\shared\file_utils.hpp
C:\btvsts\3621\private\softgrid\shared\include\shared\env_utils.hpp
C:\btvsts\3621\private\softgrid\shared\include\integration_subsystem_data.h
c:\btvsts\3621\private\softgrid\client\integration\subsystem_tokenizer_collection_factory.h
C:\btvsts\3621\private\softgrid\client\integration\PublishingCommands.h
C:\btvsts\3621\private\softgrid\client\integration\isv_client_session.h
C:\btvsts\3621\private\softgrid\client\integration\TransactionFactory.h
C:\btvsts\3621\private\softgrid\client\integration\TransactionClasses.h
C:\btvsts\3621\private\softgrid\client\integration\ActivityTransactionMap.h
c:\btvsts\3621\private\softgrid\shared\include\SwRpcClient.h
C:\btvsts\3621\private\softgrid\subsystems\include\integration_rpc_task.hpp
c:\btvsts\3621\private\softgrid\subsystems\include\integration_rpc_client.hpp
C:\btvsts\3621\private\softgrid\client\integration\notifier_process.hpp
c:\btvsts\3621\private\softgrid\shared\clientconfiguration\ValueName.h
c:\btvsts\3621\private\softgrid\shared\clientconfiguration\RegistryValue.h
C:\btvsts\3621\private\softgrid\subsystems\shortcuts\unregister_command.hpp
C:\btvsts\3621\private\softgrid\subsystems\shortcuts\register_command.hpp
C:\btvsts\3621\private\softgrid\subsystems\include\exclusion_data.h
C:\btvsts\3621\private\softgrid\shared\include\XMLUtils.h
c:\btvsts\3621\private\softgrid\subsystems\fta\xml_interface.hpp

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report