MALICIOUS — d0d2496cab95ee3dded74de1e1fd70d5866abb533ab3d246eccefd785d29d6db

MALICIOUS — d0d2496cab95ee3dded74de1e1fd70d5866abb533ab3d246eccefd785d29d6db is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 6 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: d0d2496cab95ee3dded74de1e1fd70d5866abb533ab3d246eccefd785d29d6db
SHA-1: 58092428da2bf81f07e71441ba617eeff29cab0c
MD5: b7c5f74c5bff6b76c8e94419bf6b0d28
imphash: f5e2fae08fb1c8fba965c988eb10e880
ssdeep: 24576:8uPmLDUMihIXCE5/PJLaznQOoc7CcUEpYiRj:8u+LIIX7aHCcciRj
TLSH: T109537B39565FF15ED2A6DE2248051BDC7436A43A317E202FD75B067EA3CA8378B80D24
Submitted as: d0d2496cab95ee3dded74de1e1fd70d5866abb533ab3d246eccefd785d29d6db
File type: pe · Size: 1034557 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (6 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Generickdz-9832066-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Phobos.154
Kaspersky (KVRT): HEUR:Trojan.Win32.Scar.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Malware.Generickdz-9832066-0 (rule Win.Malware.Generickdz-9832066-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Vindor!pz (rule Trojan:Win32/Vindor!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Ransom.Phobos.154 (rule Gen:Variant.Ransom.Phobos.154) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Scar.gen (rule HEUR:Trojan.Win32.Scar.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://http.proxy.icq.com/hello - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 8 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

151910 behavior events · 3 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Python3\Lib\site-packages\pip\_vendor\distlib\w32.exe - 361670e156278dd03872e10943ba567d0ffa813d344163341ec8ffb6f62ecd84
C:\Users\analyst\AppData\Local\Temp\TPFUF - 951dee16f40fa1f1331f68aac78fbd861b90047a2b4f790852abec475b59218d
C:\Python3\Lib\site-packages\pip\_vendor\distlib\w64.exe - a10f63451b0460bdd59eb978771a38a72549bd6a982e812c47445cd41ddbf14c
C:\Python3\Lib\venv\scripts\nt\pythonw.exe - 75dff66fe28a30dd3f9074ff2402b53c7017a520ae8311e84136297f578e8386
C:\Python3\Lib\site-packages\pip\_vendor\distlib\t32.exe - c64d7c15c35690be45ed2c6a54ce884d6f9153b94760369dcc45c0e48182955b
C:\Python3\Lib\venv\scripts\nt\python.exe - bc1155052c8856bfdc75e1e19bff364ac2b9e62fce3d6813fc2c176a6f2ae0b4
C:\Python3\python.exe - a7e043f0a8af19a801c4694ae01a1491f905f66d3591cd5a98f3088546d8b1bc
C:\Python3\Lib\site-packages\pip\_vendor\distlib\t64.exe - ca57645f89766792abb981cf4a903bdffdebd2dc6f272376c0b55a42402c9258
C:\Users\analyst\AppData\Local\Temp\KXOTV - 27c6328f3592e9d34da7fbd341db58863ebc60e8a39eb9a1deea9b8d593a1ed6
C:\Users\Public\Microsoft Build\Isass.exe - 3f50b11b51bdb423b2b9d2685ec48cbf0aaeb56e6312a33f602dbbab0bdef87b
C:\Users\analyst\AppData\Local\Temp\CKWOM - a27e4fe4140797d50c19ba963d4076400fce5fea3faffe184b984da930378c9f

Embedded URLs

http://http.proxy.icq.com/hello
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

http.proxy.icq.com
login.icq.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

0.0.0.1
20.184.175.16
52.253.84.76
4.230.171.124
172.178.240.162
40.84.85.40
72.153.5.97
52.148.114.188
52.110.12.4
52.110.12.55

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report