MALICIOUS — 7d669a5cba0e0fdcc6193ffdf02481c0f01f3e2c8094edbcdb3620ceae4d6feb

MALICIOUS — 7d669a5cba0e0fdcc6193ffdf02481c0f01f3e2c8094edbcdb3620ceae4d6feb is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fragtor family. 7 of 56 detection engines flagged it.

Identification

SHA-256: 7d669a5cba0e0fdcc6193ffdf02481c0f01f3e2c8094edbcdb3620ceae4d6feb
SHA-1: 1b7940732000d522379140d2d2dfa85c9dc5d843
MD5: 037f39fea5f5e50aa200eca50e2cb66a
imphash: 88ea31429606f3c27e7c33b4ee10c07a
ssdeep: 6144:4OihlcQOnlIc265F6R76e2Bs2LmXbUoLG+XhgDOlTJXBUL/Yf+soVwVf:38cQOnqc2U6R7zy/6rUoLGUhgSljUU
TLSH: T1514A019C422B9744EAF2CF4078415FAF4422E0FAA06E7D9C5B93D06F1EE0173A97505A
Submitted as: 7d669a5cba0e0fdcc6193ffdf02481c0f01f3e2c8094edbcdb3620ceae4d6feb
File type: pe · Size: 460288 bytes
Verdict: malicious (100/100) · Family: Fragtor

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Packed.Fragtor-9908420-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Ransom:Win32/StopCrypt.MSK!MTB
Emsisoft (Emergency Kit): Trojan.Crypt
Trellix Stinger (McAfee): Lockbit-FSWW!037F39FEA5F5
Kaspersky (KVRT): UDS:Exploit.Win32.Shellcode.gen

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Packed.Fragtor-9908420-0 (rule Win.Packed.Fragtor-9908420-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Ransom:Win32/StopCrypt.MSK!MTB (rule Ransom:Win32/StopCrypt.MSK!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Crypt (rule Trojan.Crypt) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Lockbit-FSWW!037F39FEA5F5 (rule Lockbit-FSWW!037F39FEA5F5) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Exploit.Win32.Shellcode.gen (rule UDS:Exploit.Win32.Shellcode.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Extracted Raccoon config (0 C2) - engine signal, weight 0.45, confidence 0.60
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

16 behavior events · 0 ATT&CK techniques · 3 dropped files.

Dropped files

46f3890d281fb0a3a699dd56627db4a4f695a04ed94b733096fd1a2c7f5add25 - 46f3890d281fb0a3a699dd56627db4a4f695a04ed94b733096fd1a2c7f5add25
790668f48efb31044ee8286bee348235b50de9d9aa40a2a6f299f02b09e7e5a6 - 790668f48efb31044ee8286bee348235b50de9d9aa40a2a6f299f02b09e7e5a6
4f7304666af14660eebdfe6da50a6eff99cf76c7695915a898e577e43f84d861 - 4f7304666af14660eebdfe6da50a6eff99cf76c7695915a898e577e43f84d861

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

4.150.223.98
4.230.171.124
172.215.188.232
20.247.184.197
135.233.95.135
4.150.223.107
20.165.94.63
4.150.223.103
135.234.160.244
52.110.12.18
52.110.12.56

File paths

C:\keteti\yofurigerime_za.pdb

More Fragtor samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report