MALICIOUS — f51bb7b90c235c491e37f823dc9eea9a898ab05187b7ca77c1ceb2d81f08b406

MALICIOUS — f51bb7b90c235c491e37f823dc9eea9a898ab05187b7ca77c1ceb2d81f08b406 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 7 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: f51bb7b90c235c491e37f823dc9eea9a898ab05187b7ca77c1ceb2d81f08b406
SHA-1: 65ebc6f1d0be3ab1be20d942634cf99fec6234da
MD5: 997535f73d073b2c9565f2d70a0eddb8
imphash: 5144a995e58e9a1dec8b8e0e5ed55aec
ssdeep: 98304:KVd9e60uVd9e60uVd9e60uVd9e60uVd9e60uVd9e60uVd9e60uVd9e60uVd9e60:+xxxxxxxxxxxxxxx
TLSH: T18B6D7CE4BE5E0006C15A2F324CC189DCA38777F9E7965A069227872C09F7D73EE20599
Submitted as: f51bb7b90c235c491e37f823dc9eea9a898ab05187b7ca77c1ceb2d81f08b406
File type: pe · Size: 12713984 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (7 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Generic-9907165-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Pidgeon.A
Emsisoft (Emergency Kit): Win32.Prepender.Gen.1
Trellix Stinger (McAfee): Flyagent.d
Kaspersky (KVRT): Virus.Win32.Agent.ev

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9907165-0 (rule Win.Trojan.Generic-9907165-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Pidgeon.A (rule Virus:Win32/Pidgeon.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Prepender.Gen.1 (rule Win32.Prepender.Gen.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Flyagent.d (rule Flyagent.d) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Agent.ev (rule Virus.Win32.Agent.ev) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
2 behavioral detection(s) across 2 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.43, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.eyuyan.com - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 30 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

70752 behavior events · 2 ATT&CK techniques · 37 dropped files.

Dropped files

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe - 8fd7ff930152b2572cd912ee3fa9f934caae3915d097fcc63ab339f0c5184128
C:\Users\analyst\AppData\Local\Temp\tsk_55e085edac264489.exe.exe.exe.exe.exe.exe.exe.exe - 3cab93ff3a12520c5bb66f45e3b7467b4642d5ba2accaf22c02e0933f2f9700e
1957d78985b582dd63d7c377ad71a4a6bc5b42d8ca734aaab62bcce719aaf43a - 1957d78985b582dd63d7c377ad71a4a6bc5b42d8ca734aaab62bcce719aaf43a
C:\Program Files\7-Zip\Uninstall.exe.exe - 558a7b3da8e1f179bc210699b93f3c9bdf2fde8fa89ecf7348e099715847cf80
C:\Program Files\7-Zip\7zG.exe.ico - 8cad493433ec34a34ca6f4fd49655aaf7cbb4337752743804db83ea6c050d1fe
C:\Program Files\7-Zip\7z.exe - 823b2b7ace1506463a6bc247fa7bf6e225287729761bc866b9c25adf29e4d992
C:\Program Files\7-Zip\7zG.exe.exe - 8498db1e0d2963a199906f06eaf5e0bf5d9ab2cb0732a877cd7fae7d09003e2f
C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe - 4306d56490a0f698fa3801254e28ae418f027886a39a0049bb4f01d59c3370f4
C:\Program Files\7-Zip\Uninstall.exe.ico - ea0420b60b078a22fdcfd40d86d589793baa2e0327b37dcdcc5399aac4037d4e
13527f104159e447e7441a62d45253eedae9556a7b113ad83049ec5a1494d55b - 13527f104159e447e7441a62d45253eedae9556a7b113ad83049ec5a1494d55b
C:\Users\analyst\AppData\Local\Temp\tsk_55e085edac264489.exe.exe.exe.exe.exe.exe.exe.exe.exe.exe.exe.exe.exe - 0b3390aa97aceb6a1c899e13ba4efab4ec4eca6f8861aadeb4c52f38220afb38
C:\Users\analyst\AppData\Local\Temp\tsk_55e085edac264489.exe.exe.exe.exe.exe.exe.exe.exe.exe.exe - d07de091a6b4f93e1b723f12a94ecb4597922a6d9e8562251cd87e56f5efdd45
C:\Users\analyst\AppData\Local\Temp\tsk_55e085edac264489.exe.exe - e6c8dfa213c5dc2263ce05219fc4d27541bccfafa665aad2105a304911636c86
C:\Program Files\7-Zip\7zG.exe - 178c5aa146ebb6c754afcc4cc83c987ad210bd7e83c4683a82d25a3a538d9cc6
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe - 3fcaf6a0f6e81c7473d5cd46b812afedc4eb5ee30801656b7f5c892a8f0cfb77

Embedded URLs

http://www.eyuyan.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.eyuyan.com
wtqq.net

Embedded IP addresses

40.79.141.154
4.149.160.182
52.123.252.198
4.230.171.124
74.178.76.54
57.155.104.224
4.150.223.113
135.233.95.144
172.64.154.167
52.110.12.15
52.110.12.40
85.210.193.152
52.148.114.188
72.145.35.104
52.110.12.51
52.110.12.46

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report