MALICIOUS — f8ae4d372a2a085b62a174ee644bc6fa5c144f247c928d8cb0776e43ceb05ef2

MALICIOUS — f8ae4d372a2a085b62a174ee644bc6fa5c144f247c928d8cb0776e43ceb05ef2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 6 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: f8ae4d372a2a085b62a174ee644bc6fa5c144f247c928d8cb0776e43ceb05ef2
SHA-1: 1644796a25cb403f17c84ef9a7e8e33b19d8d1f9
MD5: 8c2e56238f62f0638a2bbeafad25eb27
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 3072:blN9RkkkkkkTLq8Ih0dIl2GbMrKJNN8Fdg0:5dkkkkkkZI2GbMrcNK
TLSH: T1DF3EE10031BA788CD7749F6115349D9D622512C2896D3DEA5B034B5C3C6B8FBF898EB2
Submitted as: f8ae4d372a2a085b62a174ee644bc6fa5c144f247c928d8cb0776e43ceb05ef2
File type: pe · Size: 136780 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Generic-9908425-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9908425-0 (rule Win.Trojan.Generic-9908425-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Upantix.GM!MTB (rule Trojan:Win32/Upantix.GM!MTB) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Packed.Win32.Upantix.gen (rule HEUR:Packed.Win32.Upantix.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
1 behavioral detection(s) across 1 rule(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1270 behavior events · 0 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Windows\win32dc\Counter-Strike + cheat.exe - 09ef78980a0abcb7582c607d394bde1a9db0d0c428496ec16eced1ea4273838c
C:\Windows\win32dc\DAoC + fix.exe - 50c6078f6cf8de2bb6590e0b52fef5eb5966c1f8f1227da005c34f3483901c0d
C:\Windows\win32dc\Sims 2_hack.exe - 8b19e5cc21935a678bc0f58943af8f31a9b6c3e8b77d50ac843ad0f8281329f6
C:\Windows\win32dc\BattleField 1942 + cdfix.exe - 69f61548126d9b945e73b6b0a1b4d55e7d9f4ff86ff6a20aa52a402c46cdde8d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

us.undernet.org
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.117.175
52.123.252.225
4.230.171.124
85.210.193.152
52.253.84.76
74.178.240.61
74.178.240.51
40.79.163.155
4.150.223.113
172.64.154.167
135.232.92.137
186.233.185.155
52.110.12.37
52.110.12.15
20.42.73.28
51.116.253.168
52.110.12.10
52.110.12.22
52.148.114.188
72.145.35.98

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report