MALICIOUS — e8bbfe0b4662a711d86cff7304dcb807a32e28df5245f941c460f85784489c86

MALICIOUS — e8bbfe0b4662a711d86cff7304dcb807a32e28df5245f941c460f85784489c86 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upantix family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: e8bbfe0b4662a711d86cff7304dcb807a32e28df5245f941c460f85784489c86
SHA-1: 74c068c67e839fc7bf5c8f3055dbf291f25bada4
MD5: 561dd04d4be34953cfaa737fa716ce3c
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 6144:5dkkkkkkuadkkkkkkuSdkkkkkkua7dkkkkkkuadkkkkkkuSdkkkkkkuavfdkkkko:5wawSwa7wawSwaHwawSwaXTE
TLSH: T19E54D0003276399CCB309F605524599DA22552C189792DEA9B03072C3DB78BBBDECFB5
Submitted as: e8bbfe0b4662a711d86cff7304dcb807a32e28df5245f941c460f85784489c86
File type: pe · Size: 1121018 bytes
Verdict: malicious (99/100) · Family: Upantix

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Upantix.GM!MTB (rule Trojan:Win32/Upantix.GM!MTB) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Packed.Win32.Upantix.gen (rule HEUR:Packed.Win32.Upantix.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 2 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 7 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

190 behavior events · 0 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Windows\win32dc\BattleField 1942 cheat.exe - dffabb9759319bc7e281e1c99b9d0719070d1875ee6c0f727074fe5bf493430d
C:\Windows\win32dc\Silent Hill 4_trainer.exe - 50114b978790e449dba14c6223692a369268979d64d995f0975186949f2c447c
C:\Windows\win32dc\UT2004_hack.exe - 721b6047286af818084ab3d3915746e276ca1efe6321a9e13767cbad4b632a94
C:\Windows\win32dc\Doom 3_trainer.exe - c3c60e74a41f090476a959e5840b312827487934f47f361f67ceb934dd48917d
C:\Windows\win32dc\DAoC + hack.exe - cdafd1e8ba3c479f07bfceb1a10f1a57ada329df480190b55d4b51cd4b6028a2
C:\Windows\win32dc\FlatOut(cheat).exe - dd7e13d582dcdd5d8294f71934fc1da089a7566a43d70907221fcd9a876f5ed0
C:\Windows\win32dc\UT2004(crack).exe - 31bada9ca9c2191d4882e6b4dc1e9f3e68881ff25e8bd0ac4d04a8b97970acaf

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

52.230.59.222
40.79.150.122
52.123.252.223
4.230.171.124
172.64.154.167
52.110.12.24
52.110.12.25
172.215.188.225
20.42.73.28
20.50.73.15
52.148.114.188
52.110.12.20
72.154.7.106
52.110.12.4

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report