MALICIOUS — db4d6b5f5aab5abf5ab88c76f230b8a356193f962b2bec95aa11a9ba4aa4db1d

MALICIOUS — db4d6b5f5aab5abf5ab88c76f230b8a356193f962b2bec95aa11a9ba4aa4db1d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 10 of 55 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: db4d6b5f5aab5abf5ab88c76f230b8a356193f962b2bec95aa11a9ba4aa4db1d
SHA-1: b9708d244d958b64ae9d830f28003543237c855b
MD5: 1814c5f0eba5c6853ffce8f16e6c8fff
imphash: 3aaf46fe417dde7985c17bf9311368bf
ssdeep: 49152:qZIV8G9HN52lhqXChFciXZbDsD49XpzK4Hy0kBkzCym7svNSFTQ:AeT6lJR95axyOsvb
TLSH: T18160BFD5F23F5323C3AECE245868BD4DD4197168487EFBCCB983A6A604E893BE554018
Submitted as: db4d6b5f5aab5abf5ab88c76f230b8a356193f962b2bec95aa11a9ba4aa4db1d
File type: pe · Size: 3535835 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (10 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Generic-7135733-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
YARA: Yara-Rules community: YR_AntiDebug_Checks
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Downloader.CH!MTB
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Amnesia.1
Trellix Stinger (McAfee): Packed-KS!1814C5F0EBA5
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 17 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-7135733-0 (rule Win.Trojan.Generic-7135733-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://hoohoo.ncsa.uiuc.edu/docs/tutorials/imagemapping.html, https://d.symcb.com/rpa0, http://sv.symcb.com/sv.crl0W - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 29 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

49305 behavior events · 3 ATT&CK techniques · 38 dropped files.

Dropped files

C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\t32.exe - f28871c3500c92cbbdb31760a5d5a7a684ce951d7a9ce739b69f27f68c15f0e7
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - f224d027bdd3a570970d9ae546451e87edcd9edd68d92ce77df882364d047b1e
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\rmiregistry.exe - c57519138d899e8930b86b29693b1c498eaef05dcd94227e30bd6ac3133e4f69
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pkg_resources\api_tests.txt - 5c476fcb88a01c7aeadaa34734c1e795f3ba5d240a36a3b22c76e5e907297c02
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\w64.exe - 7873e3f8a853376715505903724daf768b894ed4429f77f58ea116119f810440
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\cli-32.exe - 431aafd155564ec200f9c0733a504b6a23e9f6cdb1860aa81544f703433c8ea2
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - ef33e11a92e8c4263a6c74cdf2764968a6b925bb71a52d09c59844d78142ee41
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\lib2to3\Grammar.txt - 508e62e787dd756eb0a4eb1b8d128320ca02cd246ab14cc8ce0a476dc88cc5b6
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\lib2to3\PatternGrammar.txt - ee5ba5db3b6722a0e2fbe2560ebc1c883e72328ef9c3b4da1c7c5d1cc649bce3
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\conf\security\policy\README.txt - 6da0747334b0fea7592fd92614b2bbc8b126535e129b1fee483774d914e98eb5
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\vendor.txt - 116f84ddc1395c402d545cc62278a402b38c0f118fd032d45b35e96384597c56
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccessinspector.exe - d3edaaeb75716818d353b4bc29b3a6ca6cd77586dd4597f03c36a906781a33b6
C:\Program Files\LibreOffice\program\mar.exe - 721ae2be4b2eb3dc5600964b53f9401282c9fdb27913ea6eb0d155e1ad4ad6ca
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jwebserver.exe - ea1486a1a4e0f90b65c5236b272ef45ea3340dd4e28bd546fc2c5fe1e8c18df8
C:\Program Files\LibreOffice\program\minidump_upload.exe - ac691db1d8e90ac74964e38dc23473f5eeaedc2287503af32adcf01bf26e1b59

Embedded URLs

http://go.microsoft.com/fwlink/?LinkId=9996
http://crl.verisign.com/tss-ca.crl0
https://www.verisign.com/rpa
https://www.verisign.com/rpa01
http://crl.verisign.com/pca3.crl0
http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0D
https://www.verisign.com/rpa0
http://office.microsoft.com
http://ocsp.verisign.com/ocsp/status0
http://hoohoo.ncsa.uiuc.edu/docs/tutorials/imagemapping.html
https://www.verisign.com/cps0
http://logo.verisign.com/vslogo.gif04
http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
https://www.verisign.com/cps0*
http://crl.verisign.com/pca3-g5.crl04
https://d.symcb.com/rpa0
http://sv.symcb.com/sv.crl0W
http://sv.symcb.com/sv.crt0
http://www.symauth.com/cps0
http://www.symauth.com/rpa00
http://s1.symcb.com/pca3-g5.crl0
https://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0

Embedded domains

go.microsoft.com
crl.verisign.com
www.verisign.com
crl.microsoft.com
office.microsoft.com
ocsp.verisign.com
hoohoo.ncsa.uiuc.edu
logo.verisign.com
csc3-2010-crl.verisign.com
csc3-2010-aia.verisign.com
d.symcb.com
sv.symcb.com
www.symauth.com
s1.symcb.com
www.digicert.com
crl3.digicert.com
crl4.digicert.com
cacerts.digicert.com
schemas.microsoft.com
s.symcb.com
ts-crl.ws.symantec.com
ts-aia.ws.symantec.com
pandora.be
csc3-2004-crl.verisign.com

Embedded IP addresses

3.0.1.0
3.0.1.3
2.1.4.0
8.0.241.7
8.0.181.13
9.2.0.124
20.184.175.16
52.123.252.192
4.247.188.224
4.230.171.124
4.144.132.223
48.211.4.16
52.123.252.243
74.178.76.128
20.184.175.5
135.232.92.97
52.123.129.14
20.76.201.171
52.123.128.14
40.103.64.242
20.184.175.15
203.26.79.13
172.178.240.161
52.148.114.188
52.123.252.220

Registry keys

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
HKCU\Software
HKCU\Software\Policies
HKLM\Software
HKLM\Software\Policies

File paths

P:\server\source\mapprogs\winnt\imagemap.pdb
C:\Development\VBProj\QDiff\VBGraphics.tlb
C:\WINDOWS\System32\MSVBVM60.DLL\3
C:\Program
c:\ade\jenkins\workspace\8-2-build-windows-i586-cygwin\jdk8u241\331\build\windows-i586\jdk\objs\javaw_objs\javaw.pdb
c:\workspace\8-2-build-windows-i586-cygwin\jdk8u181\11358\build\windows-i586\jdk\objs\jjs_objs\jjs.pdb

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report