MALICIOUS — bc6e5d7fbfd0f0312a511fa2aa56203c8ee62ea1c170cadf38c4063a8cfeb76d

MALICIOUS — bc6e5d7fbfd0f0312a511fa2aa56203c8ee62ea1c170cadf38c4063a8cfeb76d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fragtor family. 7 of 56 detection engines flagged it.

Identification

SHA-256: bc6e5d7fbfd0f0312a511fa2aa56203c8ee62ea1c170cadf38c4063a8cfeb76d
SHA-1: 622a229759959b3e149684d1d1c3d15c0ee40931
MD5: 206be70b68bdaeccbb8c54422912710d
imphash: 959e3f7a6ddd7b4ec96854ed6fe13765
ssdeep: 3072:o7ZLoGj1NlE9BQ0wN1m0QSNlFFi26klcLJW+Wrxpzbgqru2sxkgaBChApZa9uD6:aLxj1Nl0VwN1mm92LuzbgwujigaLwVf
TLSH: T14844BE8D56DF5743DDF5CB4038055D1EB4E2E0AAA06CBE4CDA63D01E2EE1067EA600E6
Submitted as: bc6e5d7fbfd0f0312a511fa2aa56203c8ee62ea1c170cadf38c4063a8cfeb76d
File type: pe · Size: 254464 bytes
Verdict: malicious (100/100) · Family: Fragtor

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Malware.Fragtor-9907126-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Tnega.PK!MTB
Emsisoft (Emergency Kit): Trojan.Crypt
Trellix Stinger (McAfee): Lockbit-FSWW!206BE70B68BD
Kaspersky (KVRT): UDS:Trojan-Spy.Win32.Stealer.gen

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Fragtor-9907126-0 (rule Win.Malware.Fragtor-9907126-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Tnega.PK!MTB (rule Trojan:Win32/Tnega.PK!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Crypt (rule Trojan.Crypt) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Lockbit-FSWW!206BE70B68BD (rule Lockbit-FSWW!206BE70B68BD) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan-Spy.Win32.Stealer.gen (rule UDS:Trojan-Spy.Win32.Stealer.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Extracted Azorult config (0 C2) - engine signal, weight 0.45, confidence 0.60
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

16 behavior events · 0 ATT&CK techniques · 3 dropped files.

Dropped files

ee9d8f594b44e8bba81c959fcb8b07f2d2f21043d0036326911c416aa52fd51d - ee9d8f594b44e8bba81c959fcb8b07f2d2f21043d0036326911c416aa52fd51d
3946dfb94489cdde07db77c05febb2d5b79923ffa6cd1c974716f97839a0b51a - 3946dfb94489cdde07db77c05febb2d5b79923ffa6cd1c974716f97839a0b51a
ff5fc22b83f0077b14888706a901646387d06a28c1cb74fc2b20e21070433d90 - ff5fc22b83f0077b14888706a901646387d06a28c1cb74fc2b20e21070433d90

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

2v.io

Embedded IP addresses

4.150.223.110
52.123.252.198
4.230.171.124
85.210.196.11
74.178.76.128
20.42.65.85
135.232.92.97
104.208.16.94
172.64.154.167
20.247.184.142
92.223.78.30
135.233.45.222
52.110.12.47
125.56.205.32
52.110.12.53
125.56.205.24

File paths

C:\sihamiz.pdb

More Fragtor samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report