MALICIOUS — ec0891a2260e38475d2948692f4243430a88c1b849a4c4c8c69220b49ce9c5b3.dll

MALICIOUS — ec0891a2260e38475d2948692f4243430a88c1b849a4c4c8c69220b49ce9c5b3.dll is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (79/100), attributed to the HUILoader family. 5 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: ec0891a2260e38475d2948692f4243430a88c1b849a4c4c8c69220b49ce9c5b3
• SHA-1: 35c8d1275df3dc0228d10e3f399b3a18a4fc8a9f
• MD5: 72b341521d22ceb4d5f2aeccf213ac3a
• imphash: 1f365d4e2c37b47fb208b089b5f61d49
• ssdeep: 24576:D1v/FzzBX5jCMjQCsbuQISmaYJPshPK3By2Om9Mz1dAcFQU2:DNZOI1ewy2OzDAcaP
• TLSH: T1A7593DCFE627B912CAA6A30441F4AABF09FBEC1B0271284805BF851FD6F14176616D17
• Submitted as: ec0891a2260e38475d2948692f4243430a88c1b849a4c4c8c69220b49ce9c5b3.dll
• File type: pe · Size: 1809920 bytes
• Verdict: malicious (79/100) · Family: HUILoader

Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (5 of 55 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Trojan:Win32/Qwexlafiba!rfn
• Emsisoft (Emergency Kit): Gen:Variant.Yogi.3902
• Kaspersky (KVRT): HEUR:Trojan.Win32.Inject.gen

MITRE ATT&CK

• T1547.001
• T1071.001
• T1497
• T1055

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 79/100 is the fusion of 5 weighted signals:

• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• query domain / anti-analysis (rule query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://api.cloudflare.com/client/v4/zones?per_page=1000
• https://api.cloudflare.com/client/v4/

Embedded domains

• vnd.ahead.space
• vnd.digital
• vnd.net
• vnd.sun.j2me.app
• api.cloudflare.com

File paths

• X:\:`:d:h:l:p:t:x:
• N:\:n:
• P:\:}:
• E:\:o:w:
• X:\:`:d:h:l:p:~:
• K:\:f:n:
• X:\:`:l:p:t:
• X:\:`:d:l:
• X:\:d:l:p:t:x:
• X:\:`:h:p:t:x:
• X:\:d:h:l:p:x:
• X:\:`:d:h:
• S:\:
• X:\:`:d:h:l:p:
• X:\:`:n:
• T:\:d:l:t:

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report