MALICIOUS — 3a26310944a3af4238416b3354b3c9a0c5cb362c75b996a58cd93085fecea6d4

MALICIOUS — 3a26310944a3af4238416b3354b3c9a0c5cb362c75b996a58cd93085fecea6d4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Fugrafa family. 4 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 3a26310944a3af4238416b3354b3c9a0c5cb362c75b996a58cd93085fecea6d4
SHA-1: 43673662bb7e2507bd06a975b233bbb7d1f08cb1
MD5: 53c0bf5e023d3b22ec0cbe1c08d30cd3
imphash: 1e4c0da5737da53aff5e6e0ab7de1efa
ssdeep: 384:QF/lApVGTcmZO2Zp+Nye8pqrmub8TyztsDN:QVCGToKK8o8TyJc
TLSH: T18728EB84D7E13B24CA5BD84921114C5CBF9167B3E68229DD830A9362D345BF7CEE2782
Submitted as: 3a26310944a3af4238416b3354b3c9a0c5cb362c75b996a58cd93085fecea6d4
File type: pe · Size: 17920 bytes
Verdict: malicious (99/100) · Family: Fugrafa

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Fugrafa-9806497-0
Microsoft Defender: TrojanSpy:Win32/Small.M
Emsisoft (Emergency Kit): Gen:Variant.Oberal.8
Kaspersky (KVRT): Trojan.Win32.Small.xxd

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Fugrafa-9806497-0 (rule Win.Malware.Fugrafa-9806497-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Credential Access: LSASS memory access [critical] (rule tl-cred-lsass) - dynamic signal, weight 0.80, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 29 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

74486 behavior events · 3 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787852153&P2=404&P3=2&P4=bLVMtwfkl9Ath9YyhcmIyLWPci6lFNpnxyjwki0qzNVm5E7i2S9SFbbpLIzkj99Gt%2fA0CPUI%2fMS56wDOayA7bQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787852273&P2=404&P3=2&P4=etxjpb277jWTWi5PZpZ1BxnhMaVuzpRCbXBDzscjOz5NmmEzTdnsBdPOi96%2biq1qXIFXAUdGtYHE60dEzT%2fb7w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

oneclient.sfx.ms

Embedded IP addresses

20.50.73.5
4.230.171.124
57.155.104.224
4.144.132.114
74.178.76.128
4.150.223.105
74.178.240.51
52.123.252.223
20.76.201.171
52.123.128.14
203.26.79.13
172.178.240.163
52.148.114.188
52.110.12.28
74.178.232.29
52.110.12.50
135.233.45.223
72.145.35.100
52.123.252.197
20.42.73.25
57.154.63.210
172.172.255.218
52.168.117.174
85.210.196.11
52.168.117.175

More Fugrafa samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report