MALICIOUS — Quake3 cheat.exe

MALICIOUS — Quake3 cheat.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: b7182b1394af5e8aade4c89b4463c0252dc14a1a3484501ce49f5198b82a6fb3
SHA-1: dbe3602cf26400ee8d87fd73bf1fddfd7e6c26fd
MD5: d9655103c11e865c172fd7a22b003ab7
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 12288:5wawSwaw1wawSwaw9zJwawSwaw1wawSwaw9zswawSwaw1wawSwaw9zJwawSwaw1y:na
TLSH: T13C60D100327A399CD7709F605524598DA22552C1897D3EEA9B03072D3CB78BBB9E8F71
Submitted as: Quake3 cheat.exe
File type: pe · Size: 3526542 bytes
Verdict: malicious (99/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Upantix): Doom 3 + fix.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

211 behavior events · 0 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Windows\win32dc\Doom 3 + fix.exe - 160ae06667e3fd79b750473f8b41f049a652f449e4d7f424c163571fa0ee4dbe
C:\Windows\win32dc\UT2004_trainer.exe - 19096f38a81fe01d10ac30154544d8b86513bcf61131ec268039b135700a2e41
C:\Windows\win32dc\Sims 2(hack).exe - c8ca7ef121d0f793ab6ad307d77b7297395316ae9447121ee65eea03ebb43770
C:\Windows\win32dc\Silent Hill 4(crack).exe - 7daba5bdadfe934bcfff83e8fe11f49fac593404a29d864a2dda8116d48cc2d0
C:\Windows\win32dc\Quake3_fix.exe - b81746920a234f7762567abf31bf441ef1fc356b605faea5681d527b0980ef16
C:\Windows\win32dc\Doom 3_cheat.exe - c153d34301f19b54200c75b7f770657f2014fc81f3ef80cf656afbab67d4b8b2
C:\Windows\win32dc\FlatOut + hack.exe - 9e34779b3b03c43e685fb9dcbd8902c9e1923dc944ee73434010e1389e5c38db

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=msedge.f.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787644088&P2=404&P3=2&P4=QjambC2Y4gzw3ogcw%2bdWNUWnpoDcUUH2fHUEz33vq8RPjX%2fWeICcuMCgQO%2baMcljbm01VE5g6LAHy7rJvjdQdA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

us.undernet.org

Embedded IP addresses

52.110.12.33
72.154.7.111
20.231.239.246
72.145.35.110
52.110.12.30
4.150.223.108
20.76.201.171
186.233.185.155
52.110.12.49
4.230.171.124
52.110.12.44
52.110.12.52
52.123.129.14
74.179.77.204
135.232.92.97
52.123.128.14
48.211.4.16
40.79.163.154
85.210.196.11
104.208.16.94
57.155.104.224
4.247.188.224
135.233.95.80
20.42.72.131
20.89.1.9

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report