MALICIOUS — a448e60523b9c5e05e7dba8351b0c8fddfabfbcaf6ec068d36d0460b8331aefc

MALICIOUS — a448e60523b9c5e05e7dba8351b0c8fddfabfbcaf6ec068d36d0460b8331aefc is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upantix family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: a448e60523b9c5e05e7dba8351b0c8fddfabfbcaf6ec068d36d0460b8331aefc
SHA-1: 83e454be162cf01bdf01d5b60bcbd83206addea6
MD5: b02836b243801f3da057e1d169f577fd
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 6144:5dkkkkkkuadkkkkkkuSdkkkkkkuadkkkkkkuRGbadkkkkkkuadkkkkkkuSdkkkkP:5wawSwawRGbawawSwawRGbCen
TLSH: T16352D000327A399CD7709F605524998DA12152C1897D3EEA9B03072D3CB78BBB9E8F75
Submitted as: a448e60523b9c5e05e7dba8351b0c8fddfabfbcaf6ec068d36d0460b8331aefc
File type: pe · Size: 931715 bytes
Verdict: malicious (99/100) · Family: Upantix

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Upantix.GM!MTB (rule Trojan:Win32/Upantix.GM!MTB) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Packed.Win32.Upantix.gen (rule HEUR:Packed.Win32.Upantix.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 2 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 6 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

137 behavior events · 0 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Windows\win32dc\Doom 3(fix).exe - 7b3f4e246ffc19e692605226bd21898e036087667ce35faab5ffd2cf48c39dbd
C:\Windows\win32dc\DAoC_cheat.exe - a92d3e02f26c781f82257c4fbfca362cef4ca9ad68036d166f933c1e82007235
C:\Windows\win32dc\UT2004(trainer).exe - a47f4a0184de7e1ff0c9fc1c6f2a1efd4b1989d7ce371a2b7b79b4720e3d408a
C:\Windows\win32dc\Doom 3 trainer.exe - 77260ea3d5d53957ce955f50251d00f3304d985039d60074285ffeb4a089c730
C:\Windows\win32dc\Doom 3(serial).exe - 8b4ba59d71990c0626b85fcdd35fe374c7a5af431a923a866dcb59681d087b65
C:\Windows\win32dc\Half-Life 2 + cheat.exe - be24bde536ee82382510bd1dcb92af77803b2687996b2525ede32096b0ff7b71

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

20.42.73.25
4.230.171.124
52.253.84.76
85.210.193.152
135.232.92.137
20.165.94.54
52.182.143.212
104.18.33.89
40.79.141.153
40.84.97.4
172.66.2.5
52.110.12.38
52.110.12.47
135.234.160.245
52.148.114.188
125.56.205.24
125.56.205.32
52.110.12.8
52.110.12.45

File paths

R:\A[f

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report