MALICIOUS — FYDU.exe
MALICIOUS — FYDU.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the Razy family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
b36e114e9d61275f834e19af45d6fb2a46ce9a4e5018d10ae5ae6614db600c47 - SHA-1:
7d2469d775aa6d88064befd88bf5c4da7020a7a1 - MD5:
6fed844c04a3e3572b8428d724fa44a3 - imphash:
8c235e3a9d7f61224225c532f7c9583a - ssdeep:
3072:npqWxTBjfrZYxAHnkQDJ3gIVTGtjO/VgCDsn9oHis/2lpfnmibAXHhJQzRz3LhNO:ks1frZYggIhQfNm7/vH4YQEj1 - TLSH:
T11042ADC9983E3604EDF6C8286A0F6A1D945E7047023D6C2E2B47873DDAC792F5D3095A - Submitted as: FYDU.exe
- File type: pe · Size: 212992 bytes
- Verdict: malicious (93/100) · Family: Razy
Detections (6 of 55 engines)
- capa (capabilities): capability:collection/keylog
- ClamAV (daily): Win.Malware.Razy-9759519-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Trojan:Win32/Aenjaris.AL!bit
- Emsisoft (Emergency Kit): Trojan.Agent.DCBC
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 93/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Win.Malware.Razy-9759519-0 (rule
Win.Malware.Razy-9759519-0) - engine signal, weight 0.90, confidence 0.95 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
File paths
- f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
- C:\windows\%s
- C:\windows\system32\%s
- C:\windows\system\%s
- c:\stop-adw.txt
More Razy samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report