MALICIOUS — cebd9064170673f0b139ecae9fe0e9cbb69df6f723d75f1bfd661a9991a7bb3b

MALICIOUS — cebd9064170673f0b139ecae9fe0e9cbb69df6f723d75f1bfd661a9991a7bb3b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Fugrafa family. 4 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: cebd9064170673f0b139ecae9fe0e9cbb69df6f723d75f1bfd661a9991a7bb3b
SHA-1: 1fb44f88cf7379985040c8be657d4cdecaee9e4e
MD5: 6fc3c4f31c0bcca3b02f83cf84e83b2a
imphash: 1e4c0da5737da53aff5e6e0ab7de1efa
ssdeep: 384:7F56N8swcmZO2Zp+Nye8pqrmub8TyztsDN:7brswoKK8o8TyJc
TLSH: T19328FC84D7E13B24CA5BD84921114C5CBF9167B3E68229DD830A9362D345BF7CEE2782
Submitted as: cebd9064170673f0b139ecae9fe0e9cbb69df6f723d75f1bfd661a9991a7bb3b
File type: pe · Size: 17920 bytes
Verdict: malicious (99/100) · Family: Fugrafa

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Fugrafa-9806497-0
Microsoft Defender: TrojanSpy:Win32/Small.M
Emsisoft (Emergency Kit): Gen:Variant.Oberal.8
Kaspersky (KVRT): Trojan.Win32.Small.xxd

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Fugrafa-9806497-0 (rule Win.Malware.Fugrafa-9806497-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Credential Access: LSASS memory access [critical] (rule tl-cred-lsass) - dynamic signal, weight 0.80, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082 - dynamic signal, weight 0.40, confidence 0.75
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

86228 behavior events · 3 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787822141&P2=404&P3=2&P4=dsYzuWu%2bsAlHgsxrxPODkoUcqQgAwDn3dPiiEhor9QL4AFKYUStJ1%2bQDWQfT5%2bpnQ7WE%2fjKMgowgZxBXE7DoLg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787822231&P2=404&P3=2&P4=Km2xpatjen%2bAMOsMwmIPOdjiGUuEREE5IjNvq2VXddx%2b5xmPNZJWPW%2b7sZSIofy1Li5ZIU1UiAPCdj%2fpl5B1SQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

4.150.223.103
52.123.252.223
4.247.188.224
4.230.171.124
52.230.59.222
52.123.252.248
74.178.76.128
20.184.175.10
20.165.94.54
74.179.77.204
20.112.250.133
52.123.129.14
203.26.79.13
135.233.45.221
85.210.193.152
52.148.114.188
52.123.252.224
135.233.95.80
135.234.160.246
20.42.73.24
20.42.72.131
72.145.35.97
135.232.92.34
52.110.12.22
52.110.12.3

More Fugrafa samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report