MALICIOUS — 79508d49b387712e1384375e74a378237056d7ce3a9a2d747e5e9f5cbb5cdc7b

MALICIOUS — 79508d49b387712e1384375e74a378237056d7ce3a9a2d747e5e9f5cbb5cdc7b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Small family. 4 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 79508d49b387712e1384375e74a378237056d7ce3a9a2d747e5e9f5cbb5cdc7b
SHA-1: 90ae0c771d25d5de830103a5afa25e5ad146ba85
MD5: cd5ee03113c9528d9bee8cfc8bfa34ae
imphash: 1e4c0da5737da53aff5e6e0ab7de1efa
ssdeep: 384:lFartWeUcmZO2Zp+Nye8pqrmub8TyztsDN:lg0eUoKK8o8TyJc
TLSH: T1D628EC84D7E13B24CA5BD84921114C5CBF9167B3E68229DD830A9362D345BF7CEE2782
Submitted as: 79508d49b387712e1384375e74a378237056d7ce3a9a2d747e5e9f5cbb5cdc7b
File type: pe · Size: 17920 bytes
Verdict: malicious (100/100) · Family: Small

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Fugrafa-9806497-0
Microsoft Defender: TrojanSpy:Win32/Small.M
Emsisoft (Emergency Kit): Gen:Variant.Oberal.8
Kaspersky (KVRT): Trojan.Win32.Small.xxd

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Fugrafa-9806497-0 (rule Win.Malware.Fugrafa-9806497-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Credential Access: LSASS memory access [critical] (rule tl-cred-lsass) - dynamic signal, weight 0.80, confidence 0.90
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

69397 behavior events · 3 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787913958&P2=404&P3=2&P4=gEwVFs9cvuW%2f6U8ft416TjoTnAS2om3OlfH6MZH%2bQoLKQt9VwYlZcsHcTF0b0AFskQhdDgKOhcrli8Tc14oAPw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787914096&P2=404&P3=2&P4=UBU%2bYef%2btXb1LfmQGL96n9%2fPocpdaDzMBI3MnCtzZ6A1XOeH4WZLTofqYB%2fWxcvD%2f1Ya%2b%2b8eghclmPOiLvgb3Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

104.46.162.231
52.123.252.241
4.230.171.124
52.230.59.222
85.210.196.11
52.123.252.223
135.233.95.144
74.178.240.51
52.168.117.174
4.150.223.106
20.76.201.171
52.123.128.14
52.123.129.14
40.99.134.2
203.26.79.13
135.233.45.223
52.148.114.188
172.178.240.162
74.179.71.159
72.153.5.140
4.150.223.114
40.79.150.122
4.247.188.224
74.178.232.29
52.110.12.25

More Small samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report