MALICIOUS — f0498a47aa02df7adc8e57806e337543ed5d9cfb16349204e728784a432a3538

MALICIOUS — f0498a47aa02df7adc8e57806e337543ed5d9cfb16349204e728784a432a3538 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upantix family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: f0498a47aa02df7adc8e57806e337543ed5d9cfb16349204e728784a432a3538
SHA-1: c6250b5ce3421d1f0396a29e22da360ff763f2df
MD5: eeab701c7f96297bec586e26fab0335e
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 24576:I65ocnP65ocnvBrVeRRM565ocnP65ocnvBrVeRRM7j65ocnP65ocnvBrVeRRM56+:hmps/M0mps/M7mmps/M0mps/M7vvX
TLSH: T1865C120131B5798CCA349FA45510098DA41852C6C67D2E5ADF43072A3DB38BBBED8F6B
Submitted as: f0498a47aa02df7adc8e57806e337543ed5d9cfb16349204e728784a432a3538
File type: pe · Size: 2594818 bytes
Verdict: malicious (99/100) · Family: Upantix

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9628800-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9628800-0 (rule Win.Malware.Upantix-9628800-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Upantix.GM!MTB (rule Trojan:Win32/Upantix.GM!MTB) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Packed.Win32.Upantix.gen (rule HEUR:Packed.Win32.Upantix.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 2 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 6 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

209 behavior events · 0 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Windows\win32dc\Quake3 fix.exe - b892ca28fdd3016cdfc247b3fe5878c1750327b709d128300138c637758b7851
C:\Windows\win32dc\Half-Life 2_cdfix.exe - 7fbfb20707f191d3b36a177ee5a948196f999f85a9c63b5b57ae1f6c1df3f72c
C:\Windows\win32dc\FlatOut + crack.exe - 3192edbd7389e29cac245b93ea09cb5a985c223e392b1caa55c48563f21ef692
C:\Windows\win32dc\Sims 2 + cdfix.exe - 721c034558b3cacc15395ffd086795e990ef284cb0148a872d6fedb64b23d5c9
C:\Windows\win32dc\Silent Hill 4(patch).exe - 4d2d062cb8a9f3048e7e6a4a4c1464839013c29bb32e822b76561a6cac841fd7
C:\Windows\win32dc\UT2004 + patch.exe - c4f3a2a762479018811cc88da220c91edab7db3639b75d89531e43b028c4249b

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

20.184.175.10
4.144.132.223
4.230.171.124
104.18.33.89
52.110.12.18
52.110.12.51
72.145.35.111
52.148.114.188
52.110.12.3
52.110.12.54

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report