MALICIOUS — 8ea2b1ac34967f28265a448438098fefccf172ee0dcd5f6ec6c4f1945ce0e0c4

MALICIOUS — 8ea2b1ac34967f28265a448438098fefccf172ee0dcd5f6ec6c4f1945ce0e0c4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Fugrafa family. 4 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 8ea2b1ac34967f28265a448438098fefccf172ee0dcd5f6ec6c4f1945ce0e0c4
SHA-1: 16e5c7e9e32b1092a04ed1d2069b4de26462523e
MD5: 0c7df78239f19ddd021baebb6d0652a4
imphash: 1e4c0da5737da53aff5e6e0ab7de1efa
ssdeep: 384:1FewZ4yDcmZO2Zp+Nye8pqrmub8TyztsDN:1wNyDoKK8o8TyJc
TLSH: T13B28FC84D7E13B24CA5BD84921114C5CBF9167B3E68229DD830A9362D345BF7CEE2782
Submitted as: 8ea2b1ac34967f28265a448438098fefccf172ee0dcd5f6ec6c4f1945ce0e0c4
File type: pe · Size: 17920 bytes
Verdict: malicious (99/100) · Family: Fugrafa

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Fugrafa-9806497-0
Microsoft Defender: TrojanSpy:Win32/Small.M
Emsisoft (Emergency Kit): Gen:Variant.Oberal.8
Kaspersky (KVRT): Trojan.Win32.Small.xxd

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Fugrafa-9806497-0 (rule Win.Malware.Fugrafa-9806497-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Credential Access: LSASS memory access [critical] (rule tl-cred-lsass) - dynamic signal, weight 0.80, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082 - dynamic signal, weight 0.40, confidence 0.75
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

75003 behavior events · 3 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787822767&P2=404&P3=2&P4=BKfZVJ9bF9V8cLtXHSph9x8VIgndpECZsNDOiH7NB3b1vwXrqxFwG1KIfOR8XHkOTQP6WTSXUZXruvtHQ3dcaw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787822848&P2=404&P3=2&P4=mVR72qRGrElpF7irruNNDyTM1%2bOFfFrh6CeKb25NHCVMxIxvl9hyrV8rCMFna7Jz363SSWXBxYYJjRs5EWrBAQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.184.175.18
20.42.179.204
4.230.171.124
52.230.59.222
135.232.92.137
20.165.94.54
20.42.73.25
20.165.94.63
20.231.239.246
52.123.129.14
40.104.4.2
104.46.162.231
135.234.160.244
52.123.252.203
203.26.79.13
52.148.114.188
172.178.240.163
4.150.223.108
52.138.229.67
135.233.95.80
72.154.7.109
85.210.193.152
92.223.78.30
135.232.92.34
52.110.12.52

More Fugrafa samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report