MALICIOUS — ace29d4fe1762f309e6d4fdcd1da0fa5167d654e3c048399bbe3c5ca562be3f6

MALICIOUS — ace29d4fe1762f309e6d4fdcd1da0fa5167d654e3c048399bbe3c5ca562be3f6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Fugrafa family. 4 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: ace29d4fe1762f309e6d4fdcd1da0fa5167d654e3c048399bbe3c5ca562be3f6
SHA-1: b497087031ba114255fa5148503bd8f7e264b3a5
MD5: e373e92e0d1d51af4f0582f5c24b2cca
imphash: 1e4c0da5737da53aff5e6e0ab7de1efa
ssdeep: 384:bF3vyqcBcmZO2Zp+Nye8pqrmub8TyztsDN:bhJcBoKK8o8TyJc
TLSH: T11828EB84D7E13B24CA5BD84921114C5CBF9167B3E68229DD830A9362D345BF7CEE2682
Submitted as: ace29d4fe1762f309e6d4fdcd1da0fa5167d654e3c048399bbe3c5ca562be3f6
File type: pe · Size: 17920 bytes
Verdict: malicious (99/100) · Family: Fugrafa

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Fugrafa-9806497-0
Microsoft Defender: TrojanSpy:Win32/Small.M
Emsisoft (Emergency Kit): Gen:Variant.Oberal.8
Kaspersky (KVRT): Trojan.Win32.Small.xxd

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Fugrafa-9806497-0 (rule Win.Malware.Fugrafa-9806497-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Credential Access: LSASS memory access [critical] (rule tl-cred-lsass) - dynamic signal, weight 0.80, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082 - dynamic signal, weight 0.40, confidence 0.75
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

67663 behavior events · 3 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787898390&P2=404&P3=2&P4=hnjm0QjOLyQEZEUljttVG9Irxle4PHdHr9%2f0ZFQgJ%2bDEGfVKMrvJsAlm3ozGmoYS4e464IRk8QQKkVc%2f%2f2sS3w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787898509&P2=404&P3=2&P4=MZus8ry9T0dNlf1pD6yRiQKqMkWlJ17EjfQhFAzQKABDZT6DreYBZT%2bfZ6kMH2urToG%2fqyN8qKMMTaLx0mM6qw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

51.104.15.253
52.123.252.213
40.84.97.4
4.230.171.124
52.230.60.54
135.233.95.144
135.232.92.97
4.150.223.112
74.179.77.204
20.236.44.162
40.99.134.18
52.123.129.14
52.123.128.14
135.233.45.222
172.66.2.5
52.123.252.227
135.234.160.246
203.26.79.13
52.148.114.188
74.178.232.29
72.145.35.102
52.123.252.204
74.178.76.44
52.110.12.2
52.110.12.47

More Fugrafa samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report