MALICIOUS — 330e0901e8813d07b2715acfa069563224d87e05e48a9f28ba8c2542cc249bba

MALICIOUS — 330e0901e8813d07b2715acfa069563224d87e05e48a9f28ba8c2542cc249bba is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Fugrafa family. 4 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 330e0901e8813d07b2715acfa069563224d87e05e48a9f28ba8c2542cc249bba
SHA-1: 74bf68e270705c1441fef5364c7c0145ced0184f
MD5: c55ebacc92943c02b670a1ae99f32914
imphash: 1e4c0da5737da53aff5e6e0ab7de1efa
ssdeep: 384:uFCx7GC25HcmZO2Zp+Nye8pqrmub8TyztsDN:uoR2NoKK8o8TyJc
TLSH: T16128FB84D7E13B24CA4BD84921114C5CBF9167B3E68229DD830A9372D345BF7CEE2682
Submitted as: 330e0901e8813d07b2715acfa069563224d87e05e48a9f28ba8c2542cc249bba
File type: pe · Size: 17920 bytes
Verdict: malicious (99/100) · Family: Fugrafa

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Fugrafa-9806497-0
Microsoft Defender: TrojanSpy:Win32/Small.M
Emsisoft (Emergency Kit): Gen:Variant.Oberal.8
Kaspersky (KVRT): Trojan.Win32.Small.xxd

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Fugrafa-9806497-0 (rule Win.Malware.Fugrafa-9806497-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Credential Access: LSASS memory access [critical] (rule tl-cred-lsass) - dynamic signal, weight 0.80, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

74380 behavior events · 3 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787929567&P2=404&P3=2&P4=K6IJBPFkb5SMLPBTe3QMuJC3I%2fCkrx0Ce06qv6hPlSor%2be%2bjFQTXoT42u95RGgqVeeFXBbl9cHNpnIj5xxSdUQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787929693&P2=404&P3=2&P4=aGoEvQBKhv%2fdti4TOqR9tfUTmzQSu2DgH5XlhGMhr3Ur%2fmAiJYdOmyUQNhnKKRJ93r9%2bLCofD%2b0on3FyKxAtMA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

52.168.117.174
57.155.104.224
52.123.252.230
4.144.132.114
4.230.171.124
74.178.76.128
20.42.73.28
74.178.76.54
74.179.77.204
20.112.250.133
52.123.128.14
52.123.129.14
20.184.175.17
135.234.160.245
203.26.79.13
135.234.160.244
52.148.114.188
20.165.94.46
72.153.5.96
52.123.252.233
4.247.188.224
20.184.175.20
52.168.117.169
92.223.78.30
52.110.12.21

More Fugrafa samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report