MALICIOUS — Quake3_fix.exe

MALICIOUS — Quake3_fix.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: b81746920a234f7762567abf31bf441ef1fc356b605faea5681d527b0980ef16
SHA-1: 15b4b891ef3abdb349ca598f87cbefbceeed429a
MD5: 1b83f2257536e44de2ad181bc3665140
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 12288:5wawSwaw1wawSwaw9zJwawSwaw1wawSwaw9zswawSwaw1wawSwaw9zJwawSwaw1L:nj
TLSH: T17060D100327A399CD7709F605524598DA22552C1897D3EEA9B03072D3CB78BBB9E8F71
Submitted as: Quake3_fix.exe
File type: pe · Size: 3528591 bytes
Verdict: malicious (97/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 97/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
Contacted 24 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 8 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

267 behavior events · 0 ATT&CK techniques · 8 dropped files.

Dropped files

C:\Windows\win32dc\UT2004 serial.exe - 2e1be7e373a580424584024f591ff38252951ee99705178e8834e36c66aafe13
C:\Windows\win32dc\Quake3_cdfix.exe - f13f25d94d8a0ab15d8d4b9af1b472e371657fe56cd7d945a788062f0e7d6420
C:\Windows\win32dc\Silent Hill 4(fix).exe - 401f2396cf42d5d97de76cbca6ee26ce66a1acdcf5eaff37becbb91ee4775eae
C:\Windows\win32dc\UT2004 fix.exe - c7189295903765cb10dde1d55c499bd5d83715d4690190e4ed2f1cf81fee1cbd
C:\Windows\win32dc\BattleField 1942 + nocd.exe - de3a27a7be9567712e1a7d5c46962accc3aa700413ff76107611524c72c2665f
C:\Windows\win32dc\Sims 2 + patch.exe - 6843ce3888bf1f4a45bb4201d5d5dd7ef99ac2b869aa0ec1c90d1d4f4d37334c
C:\Windows\win32dc\Sims 2 fix.exe - 9e0c9daa92ad7ee16bd4fbfbbe4fdc90898fbc265adfcaa4a2d0e55b0d87b6af
C:\Windows\win32dc\Quake3(trainer).exe - 9e861d53aa69efd67033b515d41841c4e741dd6f600fd0c91e070f69b1538470

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787665730&P2=404&P3=2&P4=SaItUqlOJUDJCYGXK1XoyUhfXt5QAuqbQgL0euDx%2fZ%2bgf6LoXXsdtcnthY%2b5VrqQhx7h9pVzPulv4H1Mhnt6AQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787665781&P2=404&P3=2&P4=kaY83C7RoKeg0nyiingWetdu%2b0YZqRGWixoEfxsP1B%2bQ55FnOgHrx5%2fuKDBJ70XZfscpqmRmFwbXvLn7zFqiTg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.42.65.89
4.247.188.233
4.230.171.124
20.247.184.142
74.179.77.204
4.150.223.108
135.233.95.135
20.76.201.171
52.123.128.14
40.103.64.242
135.233.45.222
52.123.252.244
203.26.79.13
52.123.252.216
74.178.76.44
52.148.114.188
52.110.12.3
52.110.12.31
92.223.78.30
72.154.7.105
20.165.94.46
52.110.12.16
172.178.240.161
52.110.12.46

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report