MALICIOUS — 157ba43176e0ca984c1aa2b005b826c89317d4fe6cb44de14d127926ec65fb74

MALICIOUS — 157ba43176e0ca984c1aa2b005b826c89317d4fe6cb44de14d127926ec65fb74 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Fugrafa family. 4 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 157ba43176e0ca984c1aa2b005b826c89317d4fe6cb44de14d127926ec65fb74
SHA-1: 30bc97e48a1f83f89260ee11694b38dbf443508a
MD5: 4a215da75be7ea0feb9d9c7ca5d1a912
imphash: 1e4c0da5737da53aff5e6e0ab7de1efa
ssdeep: 192:1DzmeN6XQd56HWGqXwmWDCQt1RdH0dHRdHwdHPH1SdHK18GXy8y+SeMnT3P:1DzmeKQd56CWDCQt1RqrmuwXy8y+m
TLSH: T1E828FE84D7E12724C65AE84424110C5C7F9257B3D652299E830AA377D38AFF7CEE2382
Submitted as: 157ba43176e0ca984c1aa2b005b826c89317d4fe6cb44de14d127926ec65fb74
File type: pe · Size: 17408 bytes
Verdict: malicious (99/100) · Family: Fugrafa

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Fugrafa-9806497-0
Microsoft Defender: TrojanSpy:Win32/Agent.BX
Emsisoft (Emergency Kit): Trojan.Agent.ALKT
Kaspersky (KVRT): Trojan.Win32.Small.yag

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Fugrafa-9806497-0 (rule Win.Malware.Fugrafa-9806497-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

27585 behavior events · 3 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787877986&P2=404&P3=2&P4=eCNcNG9B46kqRdAH7u5sRr4IVV5x%2f72UnyvD7xEV1EPA5NqY9P7b0Pj6OOASS5DjyNKHBBYAserNklQeHj6xRQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787878049&P2=404&P3=2&P4=BYBi9VJWW07Saq5DS2F9K%2ff4xT4YaLPe25VB4KZYx8Wq02MdQG71eYHqRXwrlEA4FaKW5%2bIdVivqjOnTmJqb5w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.184.175.13
4.144.132.114
4.230.171.124
85.210.196.11
135.233.95.144
20.165.94.54
4.150.223.107
20.112.250.133
40.103.64.226
52.123.129.14
52.123.128.14
203.26.79.13
4.150.223.103
4.207.44.71
135.234.160.244
52.110.12.48
52.110.12.11
74.178.76.44
135.233.45.222
52.148.114.188
52.123.252.197
20.42.179.192
72.145.35.97
52.110.12.14
52.110.12.51

More Fugrafa samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report