MALICIOUS — cae4bf034ec13fc0274d742dbd70ab42947cb9b3ff220f88245d72461310cab2

MALICIOUS — cae4bf034ec13fc0274d742dbd70ab42947cb9b3ff220f88245d72461310cab2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Fugrafa family. 4 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: cae4bf034ec13fc0274d742dbd70ab42947cb9b3ff220f88245d72461310cab2
SHA-1: 5e0628c8f01ab3f9fa2ea6fecfc500ba9a44158d
MD5: 76e326ff742d566138a6f17461514183
imphash: 1e4c0da5737da53aff5e6e0ab7de1efa
ssdeep: 384:lFufqXYu/cmZO2Zp+Nye8pqrmub8TyztsDN:lEfVu/oKK8o8TyJc
TLSH: T1B228EB84D7E13B24CA4BD84921114C5C7F9167B3E68229DD830A9362D345BF7CEE2682
Submitted as: cae4bf034ec13fc0274d742dbd70ab42947cb9b3ff220f88245d72461310cab2
File type: pe · Size: 17920 bytes
Verdict: malicious (99/100) · Family: Fugrafa

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Fugrafa-9806497-0
Microsoft Defender: TrojanSpy:Win32/Small.M
Emsisoft (Emergency Kit): Gen:Variant.Oberal.8
Kaspersky (KVRT): Trojan.Win32.Small.xxd

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Fugrafa-9806497-0 (rule Win.Malware.Fugrafa-9806497-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Credential Access: LSASS memory access [critical] (rule tl-cred-lsass) - dynamic signal, weight 0.80, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

71883 behavior events · 3 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787873452&P2=404&P3=2&P4=W4CZbNMUVjXdxIf8JnKPFinlBLT2LiAS26uT0U6m%2fY7NaMw66UkGOFvefVTTj7jQyGNqCt7TFGzkt5Ao3f70gw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787873535&P2=404&P3=2&P4=leyxe8oAAXzqmeeP7gfBTnoSFFCnOoVuDyoivEjsPNFEW6q4BzqTIGNy25p%2bH8T8FiBjG4ACDNDEcckULZegfw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.42.65.94
20.247.184.197
57.155.104.224
4.230.171.124
135.233.95.144
4.150.223.109
74.178.240.51
52.123.128.14
20.236.44.162
40.99.134.18
52.123.129.14
203.26.79.13
135.233.45.223
92.223.78.30
162.159.142.9
74.178.232.29
52.148.114.188
135.234.160.246
57.154.63.210
72.154.7.98
20.184.175.14
20.42.65.90
52.110.12.5
52.110.12.47

More Fugrafa samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report