MALICIOUS — bb95e5fd12e6d12741e32ed4842e369b3fb05ef8e03cb9b953e79154dce49190
MALICIOUS — bb95e5fd12e6d12741e32ed4842e369b3fb05ef8e03cb9b953e79154dce49190 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 8 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
bb95e5fd12e6d12741e32ed4842e369b3fb05ef8e03cb9b953e79154dce49190 - SHA-1:
b4404ac8547dfca32cf5826e39b6c563521d17a6 - MD5:
c95d0be37b8141c85ea89ab5070f18ea - imphash:
38aa7c2ff6ef0e48a9520d6702d08df4 - ssdeep:
3072:NnEOtEEqQizFhNGpWeFhNGpWceLaTC9hM:TeETizFhNGpWeFhNGpWceLaTC9hM - TLSH:
T1AB3B5C9E1320A22FC5F18CAB081CEDBD84C365F46A75039692D5E67840B8C37662FB95 - Submitted as: bb95e5fd12e6d12741e32ed4842e369b3fb05ef8e03cb9b953e79154dce49190
- File type: pe · Size: 104237 bytes
- Verdict: malicious (100/100) · Family: HUILoader
Detections (8 of 56 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Trojan.Agent-6943819-1
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Detect It Easy (packer/type): DIE:UPX
- Microsoft Defender: Virus:Win32/Sivis.A
- Emsisoft (Emergency Kit): Win32.Sivis.A
- Trellix Stinger (McAfee): PolyPatch-UPX
- Kaspersky (KVRT): Virus.Win32.Agent.es
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 14 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Agent-6943819-1 (rule
Win.Trojan.Agent-6943819-1) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Virus:Win32/Sivis.A (rule
Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule
Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged PolyPatch-UPX (rule
PolyPatch-UPX) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Virus.Win32.Agent.es (rule
Virus.Win32.Agent.es) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
- Detect It Easy (packer/type) flagged DIE:UPX (rule
DIE:UPX) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule
UPX) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0 - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
- Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
17361 behavior events · 0 ATT&CK techniques · 97 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- windows.msn.com
- www.msn.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- www.bing.com
- assets.msn.com
- th.bing.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- C:\$WinREAgent\Backup\location.txt -
28d3afe92493584e66d0c44da7cee242e8c6e83916774885877ea0f64e71057a - C:\Program Files\7-Zip\Lang\mr.txt -
91e9a02bacd7d6558a86b9aa3819be5b317d58c410eae3782fc1c80402ffd0cd - C:\Program Files\7-Zip\Lang\kk.txt -
8eaa14304f9db8df55165b47fc31d2152ed4ac1fc3479c30d8e46a25855f378c - C:\$WinREAgent\Backup\boot.sdi -
2ddba4e80fe0b3f23f6603086531aee1dec9bce2c759d206246d2e45031f4b56 - C:\Program Files\7-Zip\Lang\fur.txt -
b637d7950ba3ac4f17b604e2d13c3232758c717430ba9329c870647b7df0281d - C:\Program Files\7-Zip\Lang\it.txt -
4c5dc4ad7c9c27555c2e53fc839fdc3193a1899b010fcaff52bfd0cdf372956b - C:\Program Files\7-Zip\Lang\bg.txt -
b6f57edd0d05889e550112d388a4739b7870f09d7b49e7201af8a6224581477e - C:\Program Files\7-Zip\Lang\eo.txt -
de6bd9872f9da8925d771fe78cadabc8eb361c3a3c153be597512be203dc251c - C:\Program Files\7-Zip\Lang\el.txt -
8633b2c0236b09273f785e0546ee3899e203fd1a36c9301ad3a029649f486ae1 - C:\PPLFaultTemp\EventAggregationPH.dll -
5eae9811851031a56319aaea464bf38777aa24a93f614ae98a9fbe6d49fde070 - C:\Program Files\7-Zip\Lang\kaa.txt -
beaa6cb88406d72313fcb715f394da70009bb2a9b9922c8e080fe27b5aa949da - 5c871e315c1b62976a94bba79c79ff06458d2a1c1b8a9cd80745d259e1780338 -
5c871e315c1b62976a94bba79c79ff06458d2a1c1b8a9cd80745d259e1780338 - C:\Program Files\7-Zip\Lang\et.txt -
5bb8f6d83136e9cdeb4542ae2feea09c9aa2d4dbdf1500d0e5751d4100068206 - C:\792.ini -
ed2bddd2057a496b3423c3a63df80c1fd7cfba58caf5e0b2a88057eb6996b9b2 - C:\Program Files\7-Zip\Lang\hu.txt -
21d3f3336fd8dbde89eef747da66b47b233b385e9a7b8eefae8109141639af00
Embedded URLs
- http://creativecommons.org/publicdomain/zero/1.0/
- https://www.digicert.com/CPS0
- http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
- http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
- http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
- http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
- http://www.digicert.com/ssl-cps-repository.htm0
- https://d.symcb.com/rpa0
- http://s.symcb.com/universal-root.crl0
- https://d.symcb.com/rpa0@
- http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
- http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- creativecommons.org
- geocities.com
- crl3.digicert.com
- crl4.digicert.com
- www.digicert.com
- cacerts.digicert.com
- d.symcb.com
- s.symcb.com
- ts-crl.ws.symantec.com
- ts-aia.ws.symantec.com
- debian.org
Embedded IP addresses
- 2.7.6.1
- 20.42.73.27
- 52.123.252.203
- 4.230.171.124
- 20.42.179.192
- 172.64.154.167
- 74.178.76.54
- 20.247.184.142
- 52.168.112.66
- 135.233.95.144
- 172.66.2.5
- 52.110.12.3
- 135.233.45.222
- 52.110.12.32
File paths
- X:\windows\system32\sysreset.exe
- C:\Windows.old\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
- C:\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
- C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1120_none_c3e
- C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1_none_eedfed
- X:\SysResetTrace-Tel-Merge.etl,
- C:\$WINDOWS.~BT\Sources\Panther\SysResetTrace-Tel-Merge.etl)
- C:\Windows.old
- C:\.
- C:\Windows.old\Windows\System32\Config\Software.
- C:\\Windows\System32\Config\Software.
More HUILoader samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report