MALICIOUS — f51838ec3c5d8c80c273b5db5392f00e478861e69dc249aedab4ff2c2be662a1

MALICIOUS — f51838ec3c5d8c80c273b5db5392f00e478861e69dc249aedab4ff2c2be662a1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Upantix family. 6 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: f51838ec3c5d8c80c273b5db5392f00e478861e69dc249aedab4ff2c2be662a1
SHA-1: 97bc1cde4638ba3bbce69b481fed223c66bb6470
MD5: 97e9a9155d125a7814c7029c709ad57b
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 6144:5dkkkkkkuadkkkkkkuSdkkkkkkua7dkkkkkkuadkkkkkkuSdkkkkkkuavfdkkkkR:5wawSwa7wawSwaHwawSwaXT1
TLSH: T1FD54D0003276399CCB309F605524599DA22552C189792DEA9B03072C3DB78BBBDE8FB5
Submitted as: f51838ec3c5d8c80c273b5db5392f00e478861e69dc249aedab4ff2c2be662a1
File type: pe · Size: 1125185 bytes
Verdict: malicious (100/100) · Family: Upantix

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Upantix.GM!MTB (rule Trojan:Win32/Upantix.GM!MTB) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Packed.Win32.Upantix.gen (rule HEUR:Packed.Win32.Upantix.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
1 behavioral detection(s) across 1 rule(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 7 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1499 behavior events · 0 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Windows\win32dc\Sims 2(hack).exe - a3cf382823ab862731f47e3764a6f3879ff888a1eb062e55a82e7c5b5d3f30ea
C:\Windows\win32dc\Half-Life 2 + hack.exe - 2901e1f243b44d7629bbba59c3df51be8cd7fff28a4a4df26fc3666fe7714eb9
C:\Windows\win32dc\FlatOut serial.exe - 07081dae57927e7b5136e9fb96e5b6d772e924488d344844a894176c61fd11a3
C:\Windows\win32dc\UT2004 patch.exe - d09d8fba80e9adb58c63e89df757904bade408aa75e0abdbd4c917496a144455
C:\Windows\win32dc\Quake3 cheat.exe - 99aedcd2bc75d1fbc1d9a1429827b0d1b0399bfdd7d3fe320650e8306f969b5e
C:\Windows\win32dc\DAoC + codes.exe - e8ff32327c97c0f26432badeb366b6ec80cb1fe82cdc3de50ebd19204101ad63
C:\Windows\win32dc\Counter-Strike_cheat.exe - a608bade6f6ad220a1a650e5a6de41cf8d2a91efa62d15fd6b987568c6d54d77

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

us.undernet.org

Embedded IP addresses

20.184.175.12
4.230.171.124
172.215.188.225
52.230.60.54
135.232.92.97
135.233.95.144
51.105.71.137
52.182.141.63
199.71.214.87
4.150.223.104
20.42.73.26
52.110.12.32
72.153.5.60
52.148.114.188
52.110.12.33
52.110.12.15

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report