MALICIOUS — 1d9ba37b4342298cd9601b003d3ebbc61b799f1b22f12a6be1124d3c659c4a83
MALICIOUS — 1d9ba37b4342298cd9601b003d3ebbc61b799f1b22f12a6be1124d3c659c4a83 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Razy family. 6 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
1d9ba37b4342298cd9601b003d3ebbc61b799f1b22f12a6be1124d3c659c4a83 - SHA-1:
b5a4826078b9b95393776fae870c6860518ad70a - MD5:
8000f5bc980c1168a41285f0f26ef506 - imphash:
f34d5f2d4577ed6d9ceec516c1f5a744 - ssdeep:
768:vzEaCyEIXwWDhcFzrwOwvY7wrPlKimdA3Zlgy:7EvlfwrRredGjgy - TLSH:
T15D2DD0CB7A09F302E2EAC52A364249BD12F279D940F1178D1901D63159F5E27B8B728F - Submitted as: 1d9ba37b4342298cd9601b003d3ebbc61b799f1b22f12a6be1124d3c659c4a83
- File type: pe · Size: 28672 bytes
- Verdict: malicious (100/100) · Family: Razy
Detections (6 of 56 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
- ClamAV (daily): Win.Packed.Razy-7334624-0
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): Gen:Variant.NanoCore.591
- Trellix Stinger (McAfee): PWS-FCUT!8000F5BC980C
- Kaspersky (KVRT): HEUR:Trojan-PSW.MSIL.Azorult.gen
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 9 weighted signals:
- ClamAV (daily) flagged Win.Packed.Razy-7334624-0 (rule
Win.Packed.Razy-7334624-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged flagged (rule
flagged) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.NanoCore.591 (rule
Gen:Variant.NanoCore.591) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged PWS-FCUT!8000F5BC980C (rule
PWS-FCUT!8000F5BC980C) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan-PSW.MSIL.Azorult.gen (rule
HEUR:Trojan-PSW.MSIL.Azorult.gen) - engine signal, weight 0.55, confidence 0.85 - Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule
high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70 - 1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule
tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90 - Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
1666 behavior events · 0 ATT&CK techniques · 8 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- www.bing.com
- settings-win.data.microsoft.com
- assets.msn.com
- tas02.sls.update.microsoft.com
- v10.events.data.microsoft.com
- fe3cr.delivery.mp.microsoft.com
Dropped files
- b733a8c621c7b8c17d657ff619a4c093867c24f0d30f67e03e78abfbd682a5dc -
b733a8c621c7b8c17d657ff619a4c093867c24f0d30f67e03e78abfbd682a5dc - 0f7c9834fd3a551430f029f79025e5d695db7102095d86042f7317cb7cbd13fb -
0f7c9834fd3a551430f029f79025e5d695db7102095d86042f7317cb7cbd13fb - c9755626dc83b13f603a7add12ae1e9e3970354b44c707f4ffab459f19ef7315 -
c9755626dc83b13f603a7add12ae1e9e3970354b44c707f4ffab459f19ef7315 - c472e9d9c3d9b8edbe71ca97b21b61a69d4a4f70c8891bcc712cac4737a45d9a -
c472e9d9c3d9b8edbe71ca97b21b61a69d4a4f70c8891bcc712cac4737a45d9a - 6884b6001ce31caabf122c54fb5f951040db72032d2ac051ba1793552cf3acab -
6884b6001ce31caabf122c54fb5f951040db72032d2ac051ba1793552cf3acab - be6d328baa5984f935173f552e1125ab42f2f1890728a8fee08445f061716c6b -
be6d328baa5984f935173f552e1125ab42f2f1890728a8fee08445f061716c6b - b10af4eeba8aaa9ad17233213f2820740e938738d7fccfa8c274a29c955c51f6 -
b10af4eeba8aaa9ad17233213f2820740e938738d7fccfa8c274a29c955c51f6 - fad2447b6a5d9abed3cc6305fbf5e2c23db82ea6541261ee49debbc4194f36a9 -
fad2447b6a5d9abed3cc6305fbf5e2c23db82ea6541261ee49debbc4194f36a9
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded IP addresses
- 51.11.192.50
- 52.123.252.195
- 4.230.171.124
- 57.154.63.210
- 74.178.240.61
- 20.165.94.54
- 4.150.223.112
- 20.247.185.124
- 13.89.179.12
- 92.223.78.30
- 4.150.223.113
- 20.42.65.88
- 135.233.45.221
- 52.110.12.30
- 52.110.12.14
More Razy samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report