MALICIOUS — 2a67a4c0909c43bd93a7390076cf726ec5e522dca8305ac790b826df65042da8

MALICIOUS — 2a67a4c0909c43bd93a7390076cf726ec5e522dca8305ac790b826df65042da8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Fugrafa family. 4 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 2a67a4c0909c43bd93a7390076cf726ec5e522dca8305ac790b826df65042da8
SHA-1: 2401f5d9563244d2227f7fa335e8b974873ca194
MD5: 1370af1adfdab35910cb5964ba0be47f
imphash: 1e4c0da5737da53aff5e6e0ab7de1efa
ssdeep: 384:wFPIgfSfcmZO2Zp+Nye8pqrmub8TyztsDN:wlJSfoKK8o8TyJc
TLSH: T1EB28FB84D7E13B24CA4BD84921114C5CBF9167B3E68269DD830A9362D345BF7CEE2782
Submitted as: 2a67a4c0909c43bd93a7390076cf726ec5e522dca8305ac790b826df65042da8
File type: pe · Size: 17920 bytes
Verdict: malicious (99/100) · Family: Fugrafa

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Fugrafa-9806497-0
Microsoft Defender: TrojanSpy:Win32/Small.M
Emsisoft (Emergency Kit): Gen:Variant.Oberal.8
Kaspersky (KVRT): Trojan.Win32.Small.xxd

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Fugrafa-9806497-0 (rule Win.Malware.Fugrafa-9806497-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Credential Access: LSASS memory access [critical] (rule tl-cred-lsass) - dynamic signal, weight 0.80, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082 - dynamic signal, weight 0.40, confidence 0.75
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

79261 behavior events · 3 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787799959&P2=404&P3=2&P4=aaWfewjCJ4jkDHiQp9BWx3LO%2fj%2bAPpzSnJUYOotbt%2fWQ4F%2bcvNKxHo%2foDHCwhyXtSXzRofuL5vMuOZnpCD%2fcTA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787800042&P2=404&P3=2&P4=GjpuFlaHS5GxEwNcP6p9UTfsBQ4GGghqt5968H9dmD4zinLrJ2xjDxhSD58eTdftg9jSuQf3en7yB7mkPGWJow%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

aefd.nelreports.net

Embedded IP addresses

52.168.117.175
20.247.184.197
4.247.188.233
4.230.171.124
40.84.85.40
135.233.95.144
135.232.92.97
20.112.250.133
52.123.128.14
172.66.2.5
20.42.73.31
20.165.94.63
135.234.160.245
52.123.252.235
92.223.78.30
203.26.79.13
52.148.114.188
52.123.252.246
135.232.92.34
20.184.175.6
20.52.64.200
72.154.7.108
52.110.12.31
52.110.12.20

More Fugrafa samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report