MALICIOUS — caa09636ef5be5c198f4d25c35d5613923fcee8a1561c09189d55ee39b7dd50c

MALICIOUS — caa09636ef5be5c198f4d25c35d5613923fcee8a1561c09189d55ee39b7dd50c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the HUILoader family. 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: caa09636ef5be5c198f4d25c35d5613923fcee8a1561c09189d55ee39b7dd50c
SHA-1: 228c9b190d6140e4459f9155e54a5fdf3c5a909d
MD5: 280fe7d88edc2fa149cf32b322d01162
imphash: 8b1fc5c989964e6fc1675250748f63dc
ssdeep: 49152:dzvKfNuIhakf8V8ySK+JLC+ONZdIJk0TT0Th9TATRmMrm1RF4c4T4mzzB:dzMcOe8hK+JLlSHI1VmMrm1RF4hzB
TLSH: T172614ACE471F6313C2F2C62C2944559E5869BCA8647E3B4C09A3D57E49E2033FD7A06A
Submitted as: caa09636ef5be5c198f4d25c35d5613923fcee8a1561c09189d55ee39b7dd50c
File type: pe · Size: 4011769 bytes
Verdict: malicious (98/100) · Family: HUILoader

Detections (6 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
capa (capabilities): capability:collection/keylog
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
YARA: Yara-Rules community: YR_AntiDebug_Checks
Kaspersky (KVRT): HEUR:Trojan.Win32.Agentb.gen

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 98/100 is the fusion of 13 weighted signals:

Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Agentb.gen (rule HEUR:Trojan.Win32.Agentb.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 1 external host(s) and 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.30, confidence 0.70
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/CSPCA.crt0
http://www.microsoft.com/pki/certs/tspca.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

crl.microsoft.com
www.microsoft.com

Embedded IP addresses

52.168.117.174
4.230.171.124
40.84.85.40
52.230.60.54
20.165.94.63
74.179.77.164
4.150.223.96
4.150.223.100
52.178.17.2
52.110.12.22
52.110.12.37
52.110.12.28
52.110.12.52

File paths

o:\src\python-svn\lib\distutils\command\wininst-9.0-amd64.pdb
o:\src\python-svn\lib\distutils\command\wininst-9.0.pdb
X:\:`:d:h:l:p:t:x:
Q:\:b:m:s:~:

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report