MALICIOUS — 3fd033665e6bf5ceae1a46f641090c927b0b11b71260afba46be7e0a92bd6ec3
MALICIOUS — 3fd033665e6bf5ceae1a46f641090c927b0b11b71260afba46be7e0a92bd6ec3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Small family. 7 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.
Identification
- SHA-256:
3fd033665e6bf5ceae1a46f641090c927b0b11b71260afba46be7e0a92bd6ec3 - SHA-1:
5874090e03d28a777fb45a275836bada4d89dc4e - MD5:
1423eb97857a3a65dcaaf8e30d96a728 - imphash:
a5c96e0cf7e049124ffcb788427ded12 - ssdeep:
24576:n67MnVnpA1lmTx8MmA07AaSuDSwdaE6EhDK67MnVnpA1lmTx8w:67N1ahC60V7N1S - TLSH:
T154539E7E0337B313DA7ECA284A087F5E406AFC5950BA588C9267443CE3E9C67694136D - Submitted as: 3fd033665e6bf5ceae1a46f641090c927b0b11b71260afba46be7e0a92bd6ec3
- File type: pe · Size: 1048576 bytes
- Verdict: malicious (100/100) · Family: Small
Detections (7 of 56 engines)
- capa (capabilities): capability:collection/keylog
- ClamAV (daily): Win.Malware.Fugrafa-9806497-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
- Microsoft Defender: Trojan:Win32/Small.HNA!MTB
- Emsisoft (Emergency Kit): Trojan.Agent.AKHT
- Kaspersky (KVRT): Trojan.Win32.Small.xxd
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 12 weighted signals:
- ClamAV (daily) flagged Win.Malware.Fugrafa-9806497-0 (rule
Win.Malware.Fugrafa-9806497-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Small.HNA!MTB (rule
Trojan:Win32/Small.HNA!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Agent.AKHT (rule
Trojan.Agent.AKHT) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Trojan.Win32.Small.xxd (rule
Trojan.Win32.Small.xxd) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule
STRATO_Malicious_UserAgent) - engine signal, weight 0.45, confidence 0.70 - capa (capabilities) flagged capability:collection/keylog (rule
capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: http://bsalsa.com, http://bsalsa.com/, http://www.universal101.com/upd.sc - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dynamic analysis (windows)
3495 behavior events · 2 ATT&CK techniques · 0 dropped files.
Runtime network
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
- www.msftconnecttest.com
- ecs.office.com
- update.googleapis.com
- desktop-hsgcbep._dosvc._tcp.local
- desktop-hsgcbep
- login.live.com
- ctldl.windowsupdate.com
- settings-win.data.microsoft.com
- desktop-hsgcbep(1)._dosvc._tcp.local
- self.events.data.microsoft.com
- 34.226.18.2.in-addr.arpa
- time.windows.com
- 1.0.240.10.in-addr.arpa
- 188.114.148.52.in-addr.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 251.0.0.224.in-addr.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 16.4.211.48.in-addr.arpa
Embedded URLs
- http://bsalsa.com
- http://bsalsa.com/
- http://www.universal101.com/upd.sc
- http://www.universal101.com/upd02.app
- http://gomyron.com/MTgzNjk=/2/6433/ronnoagraug/
Embedded domains
- bsalsa.com
- www.universal101.com
- upd02.app
- gomyron.com
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 57.155.101.212
- 72.153.5.132
- 74.178.76.44
- 85.210.196.11
- 20.42.179.204
- 4.150.223.97
- 135.232.92.137
- 104.46.162.231
- 48.211.4.16
- 57.155.104.224
- 40.84.97.4
- 20.42.179.192
- 20.184.175.20
- 52.148.114.188
- 135.233.45.221
- 172.215.188.232
- 52.123.252.242
- 13.89.179.15
- 13.69.239.69
- 74.178.232.29
- 72.145.35.100
- 85.210.193.152
- 40.79.197.34
- 72.145.35.96
- 4.150.223.106
More Small samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report