MALICIOUS — FB831A56_lock.exe
MALICIOUS — FB831A56_lock.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 8 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
e6ec7749e3d0f750fa53b5a7619d1e5af57673d236338b3a020d0f534ec5c15d - SHA-1:
d213bccd00f98d8af608186035bc8bf814e13364 - MD5:
7ee443b0530bb9fe4c36c0faafdeb6bc - imphash:
e248a0c6591034cef1924034e9e850ee - ssdeep:
1536:2C7WFyCh6s1JlMNiOtK0lelFBaA71XtjR7o7c6M+a0:8Jhh1XSrK0Y/R87e - TLSH:
T146395BA5D0137552F0FADA69AD8408EC9036348E8177D9998B03D60DE0EAC7BDCF3589 - Submitted as: FB831A56_lock.exe
- File type: pe · Size: 92160 bytes
- Verdict: malicious (100/100) · Family: HUILoader
Detections (8 of 56 engines)
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Hash: abuse.ch ThreatFox: known-malicious-hash
- Microsoft Defender: Ransom:Win32/Majin.YAUA!MTB
- Emsisoft (Emergency Kit): Gen:Variant.Yogi.46285
- Trellix Stinger (McAfee): Ransomware-IIQ!7EE443B0530B
- Kaspersky (KVRT): HEUR:Trojan-Ransom.Win32.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 11 weighted signals:
- Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule
known-malicious-hash) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Ransom:Win32/Majin.YAUA!MTB (rule
Ransom:Win32/Majin.YAUA!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.Yogi.46285 (rule
Gen:Variant.Yogi.46285) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged Ransomware-IIQ!7EE443B0530B (rule
Ransomware-IIQ!7EE443B0530B) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan-Ransom.Win32.Generic (rule
HEUR:Trojan-Ransom.Win32.Generic) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule
STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://qtox.github.io/, http://lthicpjqc7gkn5eq3epxndc2uig3yngvcbdya4u3m3byjod5km4yuwqd.onion/ - static signal, weight 0.35, confidence 0.60
- enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - encrypt data (rule
encrypt data) - capa signal, weight 0.15, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://qtox.github.io/
- http://lthicpjqc7gkn5eq3epxndc2uig3yngvcbdya4u3m3byjod5km4yuwqd.onion/
Embedded domains
- protonmail.com
- qtox.github.io
- lthicpjqc7gkn5eq3epxndc2uig3yngvcbdya4u3m3byjod5km4yuwqd.onion
File paths
- C:\1\service.log
- C:\Windows\Temp\majin.exe
- C:\ProgramData
- C:\ProgramData\majin.bmp
- C:\majin.bmp
More HUILoader samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report