MALICIOUS — 2512e5fe8931ef5018ed8dcabdbc11409085ec0cb0646ba0dcacccfe7001b1f1

MALICIOUS — 2512e5fe8931ef5018ed8dcabdbc11409085ec0cb0646ba0dcacccfe7001b1f1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 6 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 2512e5fe8931ef5018ed8dcabdbc11409085ec0cb0646ba0dcacccfe7001b1f1
SHA-1: 81b3a6cc201eb2f01eedb9369d2380cafc95eb32
MD5: 15732939737618d30f85faf6ad8439f9
imphash: f5e2fae08fb1c8fba965c988eb10e880
ssdeep: 24576:8uPmLDUMihIXCE5JxC3lMOtHQJAXoM4LmIqBTZbhoiJ7+A1MKBLCnbn:8u+LIIX7JRgTvMKBmnr
TLSH: T1B654AF694A7B320FD37BD6688F24171C0449F885617AC5CEA3A748ADA3F6C1719CC278
Submitted as: 2512e5fe8931ef5018ed8dcabdbc11409085ec0cb0646ba0dcacccfe7001b1f1
File type: pe · Size: 1201752 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (6 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Generickdz-9832066-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Phobos.154
Kaspersky (KVRT): HEUR:Trojan.Win32.Scar.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 17 weighted signals:

ClamAV (daily) flagged Win.Malware.Generickdz-9832066-0 (rule Win.Malware.Generickdz-9832066-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Vindor!pz (rule Trojan:Win32/Vindor!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Ransom.Phobos.154 (rule Gen:Variant.Ransom.Phobos.154) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Scar.gen (rule HEUR:Trojan.Win32.Scar.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://http.proxy.icq.com/hello - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 8 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

93413 behavior events · 3 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Python3\Lib\site-packages\pip\_vendor\distlib\w32.exe - bc1fe9fc8f628bb784ed5369b27690433e0e99e8a44e48bf1c9820f050080cd6
C:\Users\analyst\AppData\Local\Temp\UNDLL - 951dee16f40fa1f1331f68aac78fbd861b90047a2b4f790852abec475b59218d
C:\Python3\Lib\site-packages\pip\_vendor\distlib\w64.exe - 924cd3cb8b9edac7ad8feb4c88eef5c8868ae74b009c291c1889647d9d751734
C:\Python3\Lib\site-packages\pip\_vendor\distlib\t32.exe - 002b08b9609cab539311f27b7d26dd1e1e72be11b108d00096256c5efeea15b1
C:\Python3\python.exe - c9f1de64d712ef1ade0e410be595dce370c501d5df995edf29bc2b681432510d
C:\Users\Public\Microsoft Build\Isass.exe - 099efe8b6a6f35e795677013c63f59a1e6b2ff7fbe267b2c1ac1ff41e8872960
C:\Python3\Lib\venv\scripts\nt\python.exe - 2f0fb2ffdb18028295655edef7c9d2805173b628466ffdbb24143b32e4267de3
C:\Users\analyst\AppData\Local\Temp\XKWIZ - 27c6328f3592e9d34da7fbd341db58863ebc60e8a39eb9a1deea9b8d593a1ed6
C:\Python3\Lib\site-packages\pip\_vendor\distlib\t64.exe - 2af84571ec99c8d754089f405e66b810540eff393f5251f2c3ddabb1c9d38d49
C:\Python3\Lib\venv\scripts\nt\pythonw.exe - 259ab431059a9d1e631a1b25fb997c5873ad72c838c86d1d64dc257b3336bacf
C:\Users\analyst\AppData\Local\Temp\EZONR - a27e4fe4140797d50c19ba963d4076400fce5fea3faffe184b984da930378c9f

Embedded URLs

http://http.proxy.icq.com/hello
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

http.proxy.icq.com
login.icq.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

0.0.0.1
4.150.223.103
172.215.188.225
52.123.252.218
20.247.184.142
172.215.188.232
4.230.171.124
135.233.95.135
135.233.95.144
172.64.154.167
20.184.175.10
74.178.240.61
52.110.12.30
52.110.12.26
135.234.160.246
52.148.114.188
20.42.65.84
72.153.5.140
52.110.12.15
52.110.12.47

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report