MALICIOUS — f56be1070c17fc1c6efd20c8554c1fe1ff03723f95f483f5d178fad80191ac91

MALICIOUS — f56be1070c17fc1c6efd20c8554c1fe1ff03723f95f483f5d178fad80191ac91 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 8 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: f56be1070c17fc1c6efd20c8554c1fe1ff03723f95f483f5d178fad80191ac91
SHA-1: 838cc0a033f1c3573adbb0f6eab7b81887af6143
MD5: 270f5e9ab8adf56cc597e521ed34d563
imphash: 435ddb61824cf7b0d9a2eafc9fb30194
ssdeep: 3072:adEUfKj8BYbDiC1ZTK7sxtLUIGcly6aqOn7ACE89zMfo0z3Z:aUSiZTK40wbaqE7Al8jkp
TLSH: T19740E09815A2DBB8E1CB8D0BD824C7EDF987EC8E2775390C451327B40B5A203D864B5B
Submitted as: f56be1070c17fc1c6efd20c8554c1fe1ff03723f95f483f5d178fad80191ac91
File type: pe · Size: 179502 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (8 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Generic-9856964-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/QQPass!pz
Emsisoft (Emergency Kit): Gen:Variant.Stealer.229
Trellix Stinger (McAfee): Trojan-FFZL!256442600CEC
Kaspersky (KVRT): Trojan.Win32.Scar.oetk

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Generic-9856964-0 (rule Win.Malware.Generic-9856964-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/QQPass!pz (rule Trojan:Win32/QQPass!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Stealer.229 (rule Gen:Variant.Stealer.229) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FFZL!256442600CEC (rule Trojan-FFZL!256442600CEC) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Scar.oetk (rule Trojan.Win32.Scar.oetk) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

7392 behavior events · 0 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\qpath.ini - bd9d989cbc9898050a0fc7d6556e012231e0ea0471466caa33c5853bc437dd5f
C:\Users\analyst\AppData\Local\Temp\Sysqamqqvaqqd.exe - a6696d235d67d43f87c988a598b8eb9ba40c9bb214f84dd7a71013f9b9c006d0
C:\Users\analyst\AppData\Local\Temp\Sysqemaxdrh.exe - e7ea4fafbfe68ae57419fdf60e7ecc6255118be497e878aa4fd7f9bc1c348259
df5e22f8881fede72e77e0819fbbb2ee664a275bcede82e06fad3ad280f21870 - df5e22f8881fede72e77e0819fbbb2ee664a275bcede82e06fad3ad280f21870

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

ietuku.com

Embedded IP addresses

20.184.175.18
52.230.60.54
52.123.252.235
48.211.4.16
4.230.171.124
135.232.92.97
20.42.73.26
74.178.76.128
172.178.240.161
135.234.160.245
52.110.12.8

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report