MALICIOUS — 6057be0d33cbc34213d284120d63a658c5c4f4a2b9eaa36306feadfd9dfe1d21
MALICIOUS — 6057be0d33cbc34213d284120d63a658c5c4f4a2b9eaa36306feadfd9dfe1d21 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fragtor family. 8 of 56 detection engines flagged it.
Identification
- SHA-256:
6057be0d33cbc34213d284120d63a658c5c4f4a2b9eaa36306feadfd9dfe1d21 - SHA-1:
fb004bac7c139a08a5398c03f27af7be72113b33 - MD5:
6dd1d220ee5bebde3c9620cc884794af - imphash:
c8cafda4e053c1cc53231f2d3aff32c4 - ssdeep:
49152:uK5PC1T0mEjcvVXhtB7vawNR8McXkLXpPmc6htlv6cIMY5hum+N8E0lM0rT:n5PC1T0pGVXhtVyh7ULXhKevi8E0lL - TLSH:
T13762338F4EFF8653FD2BDB143C54768C25F6E15C609E1C4CAC72895F23A22272625862 - Submitted as: 6057be0d33cbc34213d284120d63a658c5c4f4a2b9eaa36306feadfd9dfe1d21
- File type: pe · Size: 4420136 bytes
- Verdict: malicious (100/100) · Family: Fragtor
Detections (8 of 56 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
- ClamAV (daily): Win.Malware.Fragtor-9907126-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- LIEF (executable format parser): lief:invalid-authenticode
- Microsoft Defender: Ransom:Win32/StopCrypt.PS!MTB
- Emsisoft (Emergency Kit): Gen:Heur.Mint.Zitirez.@t1@bKLLfkmce
- Trellix Stinger (McAfee): Lockbit-FSWW!6DD1D220EE5B
- Kaspersky (KVRT): UDS:DangerousObject.Multi.Generic
Why this verdict
The malicious score of 100/100 is the fusion of 10 weighted signals:
- ClamAV (daily) flagged Win.Malware.Fragtor-9907126-0 (rule
Win.Malware.Fragtor-9907126-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Ransom:Win32/StopCrypt.PS!MTB (rule
Ransom:Win32/StopCrypt.PS!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Heur.Mint.Zitirez.@t1@bKLLfkmce (rule
Gen:Heur.Mint.Zitirez.@t1@bKLLfkmce) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged Lockbit-FSWW!6DD1D220EE5B (rule
Lockbit-FSWW!6DD1D220EE5B) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged UDS:DangerousObject.Multi.Generic (rule
UDS:DangerousObject.Multi.Generic) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- LIEF (executable format parser) flagged lief:invalid-authenticode (rule
lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule
high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
17 behavior events · 0 ATT&CK techniques · 10 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- windows.msn.com
- odc.officeapps.live.com
- www.msn.com
- settings-win.data.microsoft.com
- assets.msn.com
- www.bing.com
- licensing.mp.microsoft.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- 3ba42bbc5665241b4c8d225b5e6b49e4a2484f1857ea0f9075cd4ede26d0b4ff -
3ba42bbc5665241b4c8d225b5e6b49e4a2484f1857ea0f9075cd4ede26d0b4ff - 7f75ad59f4647e5d3b2d0594930d9e7492918365c4d8491935db40607457607c -
7f75ad59f4647e5d3b2d0594930d9e7492918365c4d8491935db40607457607c - 390ba1dc6ab55e3882b94a4af8dfc00a2eff083d147675867409066b15477fd1 -
390ba1dc6ab55e3882b94a4af8dfc00a2eff083d147675867409066b15477fd1 - 3fdfa23e6f0760e3b8667ff83ed7b4e6eaf7d347b807a5d135125a2303ca52be -
3fdfa23e6f0760e3b8667ff83ed7b4e6eaf7d347b807a5d135125a2303ca52be - d6ddf9732d4070bdfce713fe4b9b58d07cc0458e992b4c7f592dc745d5b8fb5b -
d6ddf9732d4070bdfce713fe4b9b58d07cc0458e992b4c7f592dc745d5b8fb5b - edff4d28a92c7661e01cd1bcafec23170e8f152226b885fb8463a20d2fdc387e -
edff4d28a92c7661e01cd1bcafec23170e8f152226b885fb8463a20d2fdc387e - ea8f66df0d656ccf224ab70e5e496258229309bc4a32706f9f630ec11fbb44cb -
ea8f66df0d656ccf224ab70e5e496258229309bc4a32706f9f630ec11fbb44cb - 1bbf1271ce5c9dc20b595fdf1f516166f65b443599fc835607008666296983ff -
1bbf1271ce5c9dc20b595fdf1f516166f65b443599fc835607008666296983ff - 9fdb7c1359f3f2f7279f1df4bde648c080231ed21a22906e908ef3f91f0d00ee -
9fdb7c1359f3f2f7279f1df4bde648c080231ed21a22906e908ef3f91f0d00ee - 85bc792f78db655a59733a198f69bd2bd2b6a0d505b96eb502b86a5338d2dd2a -
85bc792f78db655a59733a198f69bd2bd2b6a0d505b96eb502b86a5338d2dd2a
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- dp.de
- 6g.hk
Embedded IP addresses
- 13.89.179.15
- 4.230.171.124
- 4.247.188.224
- 20.247.185.124
- 74.178.76.54
- 74.179.77.204
- 52.178.17.234
- 135.233.95.144
- 172.178.240.161
- 52.110.12.30
- 52.110.12.47
File paths
- d:\Zm
- O:\,j9
- C:\heco\kanirudayijot-nofanaragi8.pdb
More Fragtor samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report