MALICIOUS — 3fe49763c205ff1a108d3d99c9114e0a7d8faf1536a11cda64cacc4a037534e3

MALICIOUS — 3fe49763c205ff1a108d3d99c9114e0a7d8faf1536a11cda64cacc4a037534e3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Small family. 4 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 3fe49763c205ff1a108d3d99c9114e0a7d8faf1536a11cda64cacc4a037534e3
SHA-1: 6b6d63041b51aa602aa17938bfcda3f8e3f97395
MD5: 9174082e697438a26fc338d0959df219
imphash: 1e4c0da5737da53aff5e6e0ab7de1efa
ssdeep: 384:wFijqucYcmZO2Zp+Nye8pqrmub8TyztsDN:woRcYoKK8o8TyJc
TLSH: T1AD28EB84D7E13B24CA5BD84921114C5C7F9167B3E68229DD830A9362D345BF7CEE2682
Submitted as: 3fe49763c205ff1a108d3d99c9114e0a7d8faf1536a11cda64cacc4a037534e3
File type: pe · Size: 17920 bytes
Verdict: malicious (100/100) · Family: Small

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Fugrafa-9806497-0
Microsoft Defender: TrojanSpy:Win32/Small.M
Emsisoft (Emergency Kit): Gen:Variant.Oberal.8
Kaspersky (KVRT): Trojan.Win32.Small.xxd

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Fugrafa-9806497-0 (rule Win.Malware.Fugrafa-9806497-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Credential Access: LSASS memory access [critical] (rule tl-cred-lsass) - dynamic signal, weight 0.80, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082 - dynamic signal, weight 0.40, confidence 0.75
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

76037 behavior events · 3 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787814036&P2=404&P3=2&P4=TTCiEVBChEGPqF8qPQvZ91m8KVn6nFK4i1Ljjgn68GN31jtsBjf8J%2bMlMEJxjizddy8VVwatGEKczOM%2bIUB09w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787814074&P2=404&P3=2&P4=BJ0Pzsf37E02uuBRnOh4%2b4gl1LuZ2M4bX3vWVap7F2geFyhv8JtiQFT2YipB0XjG9U0diFE4y91J4eL06CputA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

4.150.223.114
52.123.252.193
52.123.252.197
20.247.185.124
4.230.171.124
85.210.196.11
52.123.252.243
135.232.92.34
74.178.240.61
74.179.77.164
51.116.246.105
74.179.77.204
203.26.79.13
52.123.128.14
20.76.201.171
40.99.133.242
20.184.175.23
135.234.160.245
52.148.114.188
125.56.205.18
125.56.205.32
72.153.5.140
92.223.78.30
52.110.12.3

More Small samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report