MALICIOUS — 95b66a5f129945b950b0fdb5a9b477639de5764d02d778a1e68a6b1c82a56e49

MALICIOUS — 95b66a5f129945b950b0fdb5a9b477639de5764d02d778a1e68a6b1c82a56e49 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the Upantix family. 5 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 95b66a5f129945b950b0fdb5a9b477639de5764d02d778a1e68a6b1c82a56e49
SHA-1: c15f2041fd8ba4d16b89ee3a984de87f137d6813
MD5: cca7d457a9fdd85d7d268c1581d6a30f
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 6144:5dkkkkkku21Fdkkkkkku21W14OdkkkkkkoQcGpdkkkkkku21Fgmy65dZTuOP:5w23w2Q14O2QTw23gC5dZLP
TLSH: T1984CE100327A358CCB34AF605514999DA26592C5897D3EDA4B03071C3DB78BBB9E8FB1
Submitted as: 95b66a5f129945b950b0fdb5a9b477639de5764d02d778a1e68a6b1c82a56e49
File type: pe · Size: 537917 bytes
Verdict: malicious (93/100) · Family: Upantix

Detections (5 of 25 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX 3.91
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 93/100 is the fusion of 7 weighted signals:

Dropped a malicious payload (Upantix): d643eaee6bb940257bae0aa90732156db53310472a9e563b54f3f665c3f49d0c - dynamic signal, weight 0.80, confidence 0.90
Contacted 48 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:UPX 3.91 (rule DIE:UPX 3.91) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, UPX 3.91 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

86 behavior events · 1 ATT&CK techniques · 3 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/25443/files/d643eaee6bb940257bae0aa90732156db53310472a9e563b54f3f665c3f49d0c - d643eaee6bb940257bae0aa90732156db53310472a9e563b54f3f665c3f49d0c
/opt/CAPEv2/storage/analyses/25443/files/57efb1736c6b28d1425690aa6176f16bea8c275ebc33efb6e330cd6b776fcd11 - 57efb1736c6b28d1425690aa6176f16bea8c275ebc33efb6e330cd6b776fcd11
/opt/CAPEv2/storage/analyses/25443/files/b677fd017910ff98cdd4a5801e55a11ba9321ff194ee85db460f9f83a01879a1 - b677fd017910ff98cdd4a5801e55a11ba9321ff194ee85db460f9f83a01879a1

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e?P1=1786930937&P2=404&P3=2&P4=Ohj9vmkpyKCwccylIiIouYVPxRegSsXsETJtexdG4K%2bKQaIDBoU3P2PElkEHvm%2fRbQg66E%2fBCSm8L%2f%2fjiY3W%2fw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

52.123.252.215
52.182.141.63
57.155.104.224
4.230.171.124
52.253.84.76
135.233.95.135
20.165.94.63
20.42.65.94
52.123.252.241
135.233.45.222
20.165.94.54
162.159.36.2
135.233.45.221
20.89.1.9
52.148.114.188
4.247.188.224
40.84.97.4
20.112.250.133
135.234.160.246
20.184.175.3
203.26.79.13
52.123.129.14
52.123.252.248
20.231.239.246
72.145.35.117

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report