MALICIOUS — Sims 2 + codes.exe

MALICIOUS — Sims 2 + codes.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: e3a806b642659d079ccc470efc16dfa2471a5404c866a339834f124738ff91b5
SHA-1: 36833f2f46acd1ab01c90500525287411b063fed
MD5: 80e8024d24128e9cad311706b4ed0ec1
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 1536:3UUUUUUUUUUHdTD+vvvvvvvvvh+UUUUUUUC9mIkkkkkkTyhhhhhhhMSTZM+9m2Os:blN9RkkkkkkTLSBvF
TLSH: T1C23AD040317A389CD7309F611924594DA12552C28A7D3DDB9B030B2D2D7B8FBB8E8E76
Submitted as: Sims 2 + codes.exe
File type: pe · Size: 98411 bytes
Verdict: malicious (99/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Generic-9908425-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9908425-0 (rule Win.Trojan.Generic-9908425-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (HUILoader): Quake3 hack.exe - dynamic signal, weight 0.62, confidence 0.90
Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 8356) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Contacted 21 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

138 behavior events · 0 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Windows\win32dc\Quake3 hack.exe - de485127fd74b7acb8ac427c7b9de002d9d29cc3de1674c3f4d3bbabaa273991
C:\Windows\win32dc\Quake3(cheat).exe - 7fcae5e73ab457c0b48b9a15ed631cb22df6dc68485eba8cb0b181ea7f9faa6d
C:\Windows\win32dc\Half-Life 2(hack).exe - b150e32a2d26bc02393d3615708eab9cb1b85092a9ac8ace76c19ec7657b6383
C:\Windows\win32dc\Sims 2(fix).exe - 574357d1847f44dd80b0bf1825174146d3a247c9c5a1bfb75bd07c600876204a
C:\Windows\win32dc\Counter-Strike_trainer.exe - d1486611232f5543728276fe8ff477a483918109c4c3dcf04445820e0e9ef2fd

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787636881&P2=404&P3=2&P4=BKupJC7cvPbEvzJ28VVCd1QfMYPogC918ThtCle4IJtB0NwWr6X4f2t2WSOyls0SEumertDhBlCz6iJnPgf34w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787636920&P2=404&P3=2&P4=i0HGmrzvG8NDOxHeqdZpkWYscdS7BN5Q38%2b%2fwTRZHShOuNvpYjp3Eyv53IMXtiklRW8zdCPW3%2b3VHtOpTjEAcw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

52.178.17.2
52.123.252.223
172.215.188.232
4.230.171.124
57.155.104.224
20.247.184.142
74.178.76.128
20.184.175.17
135.232.92.97
20.231.239.246
52.123.128.14
135.234.160.245
92.223.78.30
135.233.95.80
203.26.79.13
52.148.114.188
48.199.12.1
72.145.35.102
52.110.12.25
135.234.160.246
52.110.12.49

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report