MALICIOUS — NewHuYue_26.8.4.1_huyue.exe
MALICIOUS — NewHuYue_26.8.4.1_huyue.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the HUILoader family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
a69e37dcd6fcb84dcfbaf607dc2c3a43849c55e936ec3fd1868e446f2516a4fb - SHA-1:
bb2c24c0e5326cc84990a11755d56c38f7d8b4f5 - MD5:
b88d55d221a302b26206117af06ca458 - imphash:
1c8abb0d55065ed8370628959ce78804 - ssdeep:
393216:Fl+Tulj0YpKp9KzmsozjWJgJfE0RfxckT/wbQF/Tnp92UcIUwz3INb:FPrpKL362KEfncb4/D31y - TLSH:
T1C473124E06071063F13EDA05F961E9DD50F3B0ABBE374849A2A7D01F52A0D2B59B3C69 - Submitted as: NewHuYue_26.8.4.1_huyue.exe
- File type: pe · Size: 22767812 bytes
- Verdict: malicious (98/100) · Family: HUILoader
Detections (5 of 56 engines)
- YARA: MalwareAnalyser built-in: Suspicious_PowerShell_Download_Exec
- capa (capabilities): capability:execution/powershell
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Kaspersky (KVRT): not-a-virus:HEUR:RiskTool.Multi.WinDivert.gen
MITRE ATT&CK
YARA
- Suspicious_PowerShell_Download_Exec
Why this verdict
The malicious score of 98/100 is the fusion of 10 weighted signals:
- Encoded/hidden PowerShell download-and-exec (rule
Suspicious_PowerShell_Download_Exec) - yara signal, weight 0.70, confidence 0.90 - Kaspersky (KVRT) flagged not-a-virus:HEUR:RiskTool.Multi.WinDivert.gen (rule
not-a-virus:HEUR:RiskTool.Multi.WinDivert.gen) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - execute via PowerShell (rule
execute via PowerShell) - capa signal, weight 0.40, confidence 0.80 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - YARA: MalwareAnalyser built-in flagged Suspicious_PowerShell_Download_Exec (rule
Suspicious_PowerShell_Download_Exec) - engine signal, weight 0.35, confidence 0.70 - capa (capabilities) flagged capability:execution/powershell (rule
capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70 - query domain / anti-analysis (rule
query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: https://youtu.youtujdshuaxin.com/index.php/get_nodes_v2, https://jrsoftware.org/ishelp/index.php?topic=setupcmdline, 7.0.0.3 - static signal, weight 0.35, confidence 0.60
- enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
- https://youtu.youtujdshuaxin.com/index.php/get_nodes_v2
- http://schemas.microsoft.com/SMI/2016/WindowsSettings
- https://jrsoftware.org/ishelp/index.php?topic=setupcmdline
- http://msdl.microsoft.com/download/symbols
Embedded domains
- schemas.microsoft.com
- i.ir
- c.gq
- 0.fr
- 6.se
- 3.gg
- i.au
- 5.de
- channel.flutter.dev
- youtu.youtujdshuaxin.com
- jrsoftware.org
- msdl.microsoft.com
Embedded IP addresses
- 7.0.0.3
File paths
- f:\[c
- a:\DR
- B:\0
- C:\M
- C:\Users\swift1\Projects\huyue\windows\runner\..\..\common\cpp\boost/asio/detail/impl/winsock_init.ipp
- C:\Users\swift1\Projects\huyue\windows\runner\..\..\common\cpp\boost/asio/detail/impl/win_mutex.ipp
- C:\Users\swift1\Projects\huyue\windows\runner\..\..\common\cpp\boost/asio/detail/impl/win_thread.ipp
- C:\Users\swift1\Projects\huyue\windows\runner\..\..\common\cpp\boost/asio/detail/impl/win_iocp_io_context.ipp
- C:\Users\swift1\Projects\huyue\windows\runner\..\..\common\cpp\boost/asio/impl/io_context.ipp
- C:\Users\swift1\Projects\huyue\windows\runner\..\..\common\cpp\boost/asio/detail/impl/socket_select_interrupter.ipp
- C:\Users\swift1\Projects\huyue\windows\runner\..\..\common\cpp\boost/asio/ip/impl/address_v4.ipp
- C:\Users\swift1\Projects\huyue\windows\runner\..\..\common\cpp\boost/asio/ip/impl/address_v6.ipp
- C:\Users\swift1\Projects\huyue\windows\runner\..\..\common\cpp\boost/asio/ip/detail/impl/endpoint.ipp
- C:\Users\swift1\Projects\huyue\windows\runner\..\..\common\cpp\boost/asio/detail/win_iocp_socket_service.hpp
- C:\Users\swift1\Projects\huyue\windows\runner\..\..\common\cpp\boost/asio/detail/win_iocp_socket_recv_op.hpp
- C:\Users\swift1\Projects\huyue\windows\runner\..\..\common\cpp\boost/asio/detail/win_iocp_socket_send_op.hpp
- C:\Users\swift1\Projects\huyue\windows\runner\..\..\common\cpp\boost/asio/detail/win_iocp_socket_connect_op.hpp
- R:\2
- C:\Coding\Is\issrc-build\Components\ChaCha20.pas
- x:\dirname
- c:\websymbols
More HUILoader samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report