MALICIOUS — b49bd9530a940c573bb228e2945c1281a6621cc6aa61600bf11eb859f93ff52b

MALICIOUS — b49bd9530a940c573bb228e2945c1281a6621cc6aa61600bf11eb859f93ff52b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 6 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: b49bd9530a940c573bb228e2945c1281a6621cc6aa61600bf11eb859f93ff52b
SHA-1: 52183bdb2392e423228d0b074d16e709cf4b5e48
MD5: 6184f0935baaf6660241e9d028bbc746
imphash: a8f69eb2cf9f30ea96961c86b4347282
ssdeep: 6144:/6E5iw+W2aZixTmAcThAkZThMTMgixTmAcThAkZThMTM:i6aWZix1c60yTix1c60y
TLSH: T159436D1B515AD91FD2569B323B88C68E5C83F04881B5D67603CEE23E843953F7BB9062
Submitted as: b49bd9530a940c573bb228e2945c1281a6621cc6aa61600bf11eb859f93ff52b
File type: pe · Size: 227040 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Agent-6943819-1
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-6943819-1 (rule Win.Trojan.Agent-6943819-1) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Sivis.A (rule Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Agent.es (rule Virus.Win32.Agent.es) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, http://www.gnu.org/licenses/, https://www.gnu.org/software/automake/manual/automake.html - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Extracted generic config (4 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

18834 behavior events · 0 ATT&CK techniques · 97 dropped files.

Dropped files

C:\Program Files\7-Zip\7-zip32.dll - a6d45fd44fd57ded83f74670ec4ba688607fa0ea844a1aa5188ce9a23ecf6fc1
C:\Program Files\7-Zip\Lang\mng.txt - 2ffec19538e662f128e862d7358590f24b54d1bf55d9f35c69914ca90f3c33ef
C:\$WinREAgent\Backup\ReAgent.xml - a851da8726aaac584ef9e3e596784f540bddaaf86442ae82d64c9165cc6529e7
C:\PPLFaultTemp\EventAggregationPH.dll - 71d6dbdc63d9799d7d154eaca4f4245e88bf7d36d0446e22d524f4f325b7cbd5
C:\812.ini - 92898edea44fb186dab87ae5928912336cf88a7098e59790cb9b49e43115d6be
C:\Program Files\7-Zip\7z.exe - d4b2edf2550f83c5f086a1f7c648078e8970c920b5373acf660204385dcdf104
C:\Program Files\7-Zip\Lang\ps.txt - 1501fd0bf897d0e64cde4f6fdbc0bf7b9aee5bb43571266dd4280d7eb996f3ea
C:\Program Files\7-Zip\Lang\io.txt - 7736ae5160ea41a01b65c703a558fd62a5b990efe1478068b5b223d2474004bb
C:\Program Files\7-Zip\Lang\cs.txt - 759f31d0b6a176f722ff8236644b4a3d5d8e36e96bfa2964c0aba8d3124f5304
C:\Program Files\7-Zip\Lang\fy.txt - 5755ec79a513b01b03fee6fd27f4841275706d4433813f353b1e06fcd695383c
C:\Program Files\7-Zip\Lang\ro.txt - d06f190cb54231a79e82c3af68d0237ce97ec168dea91fe6fbf71acc13bb97b3
C:\Program Files\7-Zip\Lang\ka.txt - 85115ac247b57c569de7f8c2f0b796f4da23eb23020edf4d41288e717a2acdbe
C:\Program Files\7-Zip\7-zip.dll - 378fe69613af4395ae7eba95780aab6bd1c3e52a2108705adb556f2f0789457c
C:\Program Files\7-Zip\Lang\es.txt - 81cec264c10f38b4b531e76903290b7d352d8ab73750fb8c2940641900b1114d
C:\Program Files\7-Zip\Lang\bg.txt - 7beb491d78834c6b80ab8177ae3f9a870d81fcb7c2e3e7fe9785a3913e879b4b

Embedded URLs

http://schemas.openxmlformats.org/drawingml/2006/main
http://creativecommons.org/publicdomain/zero/1.0/
http://schemas.microsoft.com/appv/2010/FilesystemMetadata
http://www.gnu.org/licenses/
http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com/0
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
https://www.gnu.org/software/automake/manual/automake.html
http://fsmsh.com/2753
https://autotools.io/index.html
http://miller.emu.id.au/pmiller/books/rmch/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

schemas.openxmlformats.org
creativecommons.org
schemas.microsoft.com
geocities.com
www.gnu.org
crl.microsoft.com
www.microsoft.com
office.microsoft.com
fsmsh.com
autotools.io
miller.emu.id.au
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

51.116.253.170
52.123.252.243
4.230.171.124
20.42.179.192
20.247.185.124
74.179.77.204
74.178.240.51
20.42.73.27
135.232.92.137
57.155.101.212
162.159.142.9
20.42.73.26
135.233.45.223
92.223.78.30
52.110.12.10
52.110.12.48

File paths

C:\Program

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report