MALICIOUS — FlatOut + serial.exe

MALICIOUS — FlatOut + serial.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: e980451a70db45e732f2dc339e9be70c27e84e4784fd721c3c1acbde4587b69b
SHA-1: ddd2768bc22498274460847441183ace87cd789b
MD5: 0077cfc7aa6976f14f6b1d5831ec92f0
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 1536:3UUUUUUUUUUHdTD+vvvvvvvvvh+UUUUUUUC9mIkkkkkkTyhhhhhhhMSTZM+9m2Os:blN9RkkkkkkTLSBvyi/z
TLSH: T1293BC04071BA39CCD7309F611924594DA12152C28A793D9B5B030B2D3D7B8FBB8E8E76
Submitted as: FlatOut + serial.exe
File type: pe · Size: 105581 bytes
Verdict: malicious (97/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Generic-9908425-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 97/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9908425-0 (rule Win.Trojan.Generic-9908425-0) - engine signal, weight 0.90, confidence 0.95
Contacted 27 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

107 behavior events · 0 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Windows\win32dc\Counter-Strike(codes).exe - 49595f4959bbd3b2a24bb4df1de079212bf9422156bdc07e27d6e0031baf095d
C:\Windows\win32dc\Sims 2(nocd).exe - 7ccb517a8914d15f860906b71fd6db026629c80658768122c7bc263eb9738c1e
C:\Windows\win32dc\Counter-Strike_crack.exe - 5aa676c1939c0444c9126fad838e4249bf98576044588364ade1d02ee986e924
C:\Windows\win32dc\Half-Life 2 codes.exe - 8e928c2c85d6be94fdf797e64ef06d934b21407776f7def59213cfcf9ede28c7

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787639441&P2=404&P3=2&P4=JpQSNasIDHzz3p2ubUaU%2ffO3fGSD3snlMstFgZilqp8WcVMWg%2bAkJ3xk8Uj75Ohg%2f0kri6ZrgHmA4bZjJGCUpw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787639514&P2=404&P3=2&P4=F2RVLwRa965V1YF8JoeB8htQs8bASdB%2flxdsdV%2bjzpfvVl1pVap4ajIoew1XndsCzyKhuEsb2ztBy4HedmQdgg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

40.79.141.152
52.123.252.248
20.42.179.204
4.144.132.223
4.230.171.124
74.178.76.128
52.178.17.234
74.178.240.51
40.103.64.226
52.123.129.14
20.236.44.162
40.99.133.226
52.123.128.14
20.184.175.13
203.26.79.13
135.233.45.222
52.123.252.220
20.165.94.46
52.123.252.218
52.148.114.188
52.110.12.18
52.110.12.55
72.145.35.101
135.234.160.245
52.123.252.240

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report