MALICIOUS — Doom 3_cheat.exe

MALICIOUS — Doom 3_cheat.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: dce43c3f132ec8a2fcd39a07687ad205588e14bbda23680322e8a01ce9579a10
SHA-1: afea3894d9bfd326f3935f53888148481b465c90
MD5: 97f5aa6d03b2cd5e49f36dec5fd5bb30
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 12288:5wawSwaw1wawSwaw9zJwawSwaw1wawSwaw9zswawSwaw1wawSwaw9zJwawSwaw1V:d
TLSH: T1AD60D100327A399CD7709F605524598DA22552C1897D3EEA9B03072D3CB78BBB9E8F71
Submitted as: Doom 3_cheat.exe
File type: pe · Size: 3525636 bytes
Verdict: malicious (98/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 30 external host(s) at runtime (25 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 7 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1601 behavior events · 0 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Windows\win32dc\Silent Hill 4_nocd.exe - 2c9ed3c6d2045fb748241477c00f5ae8a1824d2a7015d9a83849e36dfc4302ab
C:\Windows\win32dc\Half-Life 2_nocd.exe - e8f32fc9f6938c318d655078e66262bcb2eacca99d402ed811eb413e69a2e244
C:\Windows\win32dc\Sims 2 + cheat.exe - 25a715084adae62027a7fcaec4edc195d74ead008a86beec0b6cb2d774890673
C:\Windows\win32dc\Counter-Strike cheat.exe - bbe1d31cf8a2372a19327fbf0a1a5c4b6fc5e6d068172d94d92275f92979cc09
C:\Windows\win32dc\Silent Hill 4(hack).exe - d1ae1d9fafe62688d4f9e4f75c240ac03c5d4596dd18a6ee84f55075fa52b437
C:\Windows\win32dc\UT2004 + trainer.exe - 916ff125d83556960e4926ad0223321010370be8f7a90d8ae890c3859041cea5
C:\Windows\win32dc\Sims 2 cdfix.exe - f1cb31af54177fefc98caef92db0947fa11696096ff7ee0a4b3aef2f9a31b578

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787673192&P2=404&P3=2&P4=W%2fUKfwjLZ%2fEFBgnCVPTk1rBBda%2bopFKZjnkVsP6teLW4UQJy3764u9J9awwMaoGlhkbuqgfmf7z%2fjtdADU%2f0pQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787673219&P2=404&P3=2&P4=Odxa1zASxZ6gHBMFuiMLAw5vYR%2bXcaaBWnQA%2barzn1Lh90e8ZMWv4dKv42X%2b0soIq56%2b4k8QrztDOg8FEyv9eg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

us.undernet.org

Embedded IP addresses

203.26.79.13
13.69.109.130
52.123.252.236
20.42.179.192
4.230.171.124
20.247.185.124
135.233.95.144
74.178.240.51
51.116.246.105
20.236.44.162
52.123.129.14
52.123.128.14
20.42.65.94
52.123.252.215
74.179.71.159
52.123.252.212
172.178.240.163
172.83.156.122
52.148.114.188
92.223.78.30
172.66.2.5
72.145.35.107
52.110.12.38
52.110.12.44
52.123.252.219

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report