MALICIOUS — Laniakea.exe

MALICIOUS — Laniakea.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (85/100), attributed to the HUILoader family. 2 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: e2a5172986c555b0d9865ac81091961a536da1f4dee99a2b9190e02b1f61c2cb
SHA-1: 9cbbaf3bca9d2c5b5d37d439e45f0124e36887ac
MD5: db54dd1dd8aa1e36379560d5db5a3047
imphash: bf04815876a5638bad396750c58e13b6
ssdeep: 49152:ShpdESqGjLvi2U9AO7MvNrC1vSZQMbiRR6J2lQUOoTgfZ5m5ErF41uRIQkpjD7i:kOXzQv5Guf+Tli45fwhNot
TLSH: T191677D46104F2630C63ADB15BC62B1FDA5F3B09326360449B287E57EA855C2F2DA247F
Submitted as: Laniakea.exe
File type: pe · Size: 7164928 bytes
Verdict: malicious (85/100) · Family: HUILoader

Detections (2 of 55 engines)

capa (capabilities): capability:collection/keylog
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad

MITRE ATT&CK

Why this verdict

The malicious score of 85/100 is the fusion of 8 weighted signals:

capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 25 external host(s) at runtime (31 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.metal-machine.de/readerror/, https://www.hwinfo.com/, https://www.paypal.com/cgi-bin/webscr?cmd=_xclick&business=NetMeter%40gmx%2ede&item_name=Laniakea&no_shipping=0&no_note=1&tax=0&currency_code=USD&lc=US&bn=PP%2dDonationsBF&charset=UTF%2d8 - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

1998 behavior events · 1 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.metal-machine.de/readerror/
https://www.hwinfo.com/
http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://schemas.microsoft.com/SMI/2016/WindowsSettings
https://www.paypal.com/cgi-bin/webscr?cmd=_xclick&business=NetMeter%40gmx%2ede&item_name=Laniakea&no_shipping=0&no_note=1&tax=0&currency_code=USD&lc=US&bn=PP%2dDonationsBF&charset=UTF%2d8
https://commons.wikimedia.org/wiki/File:Laniakea-2.jpg
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787786227&P2=404&P3=2&P4=Hxl%2bB1AOXowTSQ4as10ilGr2%2brwIRRyB%2bdmv2LPifpZpLd4PwSZiTT2eyRtMABPYUCeLLm9W0ds%2bxjmN%2fv1Bpg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787786325&P2=404&P3=2&P4=NkFxNIz0XtffhM06dxQqW249%2faUH9mS%2fgDgVhpKPCcwHH9N%2b3TO%2bafwTTomgIGoGoeaapaUdKEbBVCDBkQR2cg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787183077&P2=404&P3=2&P4=flmXJKrstx8Gbg3rq4ic9NYLzXumuak11UY3FreyIpAPMfaJ4BZcMUrTC3Rq2wLNCWF9BbEsGqPUSI2qoKrrdQ%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787182604&P2=404&P3=2&P4=JPTmoJChKc6boK9vUDGOo0x7Agu8WH%2f0eB15eiwH3peBWwHjhrnz7MYVP4wYWn9gGF%2bcJB%2bEpRf9E2U6I2wE5g%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

y4.in
www.metal-machine.de
gmx.de
www.hwinfo.com
schemas.microsoft.com
www.paypal.com
commons.wikimedia.org

Embedded IP addresses

20.52.64.201
4.247.188.233
4.144.132.114
4.230.171.124
74.178.240.61
135.233.95.135
52.178.17.3
203.26.79.13
40.104.4.2
52.123.129.14
20.112.250.133
52.123.128.14
162.159.142.9
52.168.112.67
74.178.76.44
172.178.240.161
52.148.114.188
72.145.35.109
172.170.180.133
4.150.223.104
20.42.65.93
142.251.42.99
92.223.78.30
52.110.12.40
52.110.12.5

File paths

f:\SI
C:\Users\TheBl\Documents\Embarcadero\Studio\Components\graphics32\Source\GR32_System.pas
C:\Users\TheBl\Documents\Embarcadero\Studio\Components\graphics32\Source\GR32_Resamplers.pas
C:\Users\TheBl\Documents\Embarcadero\Studio\Components\graphics32\Source\GR32_Layers.pas
C:\Users\TheBl\Documents\Embarcadero\Studio\Components\graphics32\Source\GR32_Image.pas
C:\Users\TheBl\Documents\Embarcadero\Studio\Components\graphics32\Source\GR32_VectorUtils.pas
C:\Users\TheBl\Documents\Embarcadero\Studio\Components\graphics32\Source\GR32.pas
C:\Users\TheBl\Documents\Embarcadero\Studio\Components\graphics32\Source\GR32_ColorGradients.pas

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report