MALICIOUS — 350b8e4c753c162f9e30e94aad1907347fe2291566c38632e97461045e4a17d1

MALICIOUS — 350b8e4c753c162f9e30e94aad1907347fe2291566c38632e97461045e4a17d1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Razy family. 6 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 350b8e4c753c162f9e30e94aad1907347fe2291566c38632e97461045e4a17d1
SHA-1: de071d5a2421d1a1b2525b9e2d0a6f5ebf0c9322
MD5: bedd5771e9c2377f1f740f5c01821600
imphash: 8c235e3a9d7f61224225c532f7c9583a
ssdeep: 3072:DA7W5vC/30VJADmkE/VFPKpeOu9K9Qvw8TWv004pLthEjQT65:osvA3+JAakZpeOulvFWnkEjP
TLSH: T1AD427CCA8D669941C4B8E1211C10FD8C9853E1E7E43C6A4EC35BB5E69DDB01F7A304EA
Submitted as: 350b8e4c753c162f9e30e94aad1907347fe2291566c38632e97461045e4a17d1
File type: pe · Size: 213486 bytes
Verdict: malicious (98/100) · Family: Razy

Detections (6 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Razy-9759519-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Aenjaris.AL!bit
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Babuk.69
Kaspersky (KVRT): Trojan.Win32.Nobady.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Razy-9759519-0 (rule Win.Malware.Razy-9759519-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 28 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Dropped 11 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

45600 behavior events · 2 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Windows\ABHARAK.exe - 5ee08383d055d73d9566143da4434ac7faf29cfaa00bdadd864913b9287662d1
C:\Windows\System\SCPZHUD.exe - 19b88128a52a9f8ce37369ccbecf5ac389d6e0253285d10a6c478185d4652706
C:\Windows\System32\FFQNLUO.exe - d699a63866b213a343d8c444118747583569789e0fe3c8fc5b270cbaaf1df219
C:\Windows\System\TJKRLG.exe - e2d06e7db84ccd853d20c24ea553d09a241cbd4d98858dbca20262f99a6e97ff
C:\Windows\System\WEMDQWH.exe - 26eb8f5a2d574d70a6346a7bbb39cf4d255139efbc74922bc963e8600c63d1df
C:\Windows\System\VAFI.exe - adf396821fbd641609eee055c6bf0ab21137540a6f737baf4c7086d406d8a5fd
C:\Windows\System32\BRRA.exe - e89cac71261a4e7652603c065b5c840c6d8580fdfaa1b2cfcbd655fd4b910526
C:\Windows\System32\COPXVPH.exe - fbffa41a8972417c00c5f0f9a5d51a4da6cfdb6fc56db639c27c715c99b70610
C:\Windows\System32\JJWIZ.exe - 3364657e831c29d0991d2ea8e5edcd4b7c39c4026b55167bcbec14b8aecadd7a
C:\Windows\System\MPWL.exe - 14bb22c73881235a21e181567730f6f7e85d578a9765aca69cf3b1a9f7e3bd7f
C:\Windows\PTHDKLY.exe - ad31195dab1837dd6c0fa21fa5142a051eab9888be9636fc9ddab451d1be43b6

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787865383&P2=404&P3=2&P4=EmTNbleOlwL90pvEg1IZpwXYfHJdyEb9VSLht7kjr92xIc5SAMMJeT9kmAKa0zq8aLoBWzd7dWiXn9LVmDfCwA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787865483&P2=404&P3=2&P4=L%2bErM%2bugR%2f%2bsqOHTfMji6jN8wew1ESQzS35%2bV2E9lolgt9OYTKLcsvktib1GciUXzRA5u5GJPWKx01bo6eNYOw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

aefd.nelreports.net

Embedded IP addresses

20.184.175.17
40.84.85.40
4.230.171.124
20.247.184.142
74.178.76.128
40.79.197.34
74.178.240.51
74.179.77.204
52.123.129.14
20.231.239.246
4.150.223.110
172.178.240.161
135.234.160.245
135.233.45.221
92.223.78.30
52.123.252.220
52.148.114.188
203.26.79.13
135.233.45.222
172.178.240.162
135.233.45.223
20.165.94.46
48.211.4.16
4.150.223.102
52.168.117.175

File paths

f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
C:\windows\%s
C:\windows\system32\%s
C:\windows\system\%s
c:\stop-adw.txt

More Razy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report