MALICIOUS — 0a320a2aba4c6d86ccfdddc60219d18eb545ca209887d5191511eb2a529eda20

MALICIOUS — 0a320a2aba4c6d86ccfdddc60219d18eb545ca209887d5191511eb2a529eda20 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the C83B492E family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 0a320a2aba4c6d86ccfdddc60219d18eb545ca209887d5191511eb2a529eda20
SHA-1: ca223631ee43ff38550878407a95c98c8786c2e6
MD5: 81bb817fe4ee3bf00a09c848968e2a1c
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dyVqOFcPRIF/JqwWTxQCz6:Qoa1taC09aP2/JKxQCu
TLSH: T1545A238A6A1A6B0CF1F6C4802D69066EC401D8E7533815CB928FF05EB7DB95BB8111DF
Submitted as: 0a320a2aba4c6d86ccfdddc60219d18eb545ca209887d5191511eb2a529eda20
File type: pe · Size: 1958400 bytes
Verdict: malicious (98/100) · Family: C83B492E

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\34C6.tmp - 24a4e6785e673a8d4e2f60d81aa9aadf3eee4f7205d34f4079f15a71334f396b
6816374213ef423ac106b1e60fdcc9f59ef09d8296359d72d9fae4cc07ac1c9a - 6816374213ef423ac106b1e60fdcc9f59ef09d8296359d72d9fae4cc07ac1c9a

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787905252&P2=404&P3=2&P4=W66mHPMqGPYWLuVbnvQpvay%2f2uO8kvwdUhw%2b8O1UTWHEbYjkt7frdA22cG9%2b16qEQT2juwd4ocA9Y7Vn7Jt6wg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787905321&P2=404&P3=2&P4=B5O9gNR5cwe48wHn8%2fEn1LT6QRceAOU8qHbyncjCg%2f7RvTtFClvaPVCktrxEXv6we1qB4r89%2fsHQp0Bzi5CO%2fg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

52.168.117.169
20.42.179.192
20.247.184.197
4.230.171.124
74.179.77.204
20.42.72.131
74.178.240.51
74.178.76.128
20.76.201.171
52.123.128.14
52.123.129.14
40.103.64.242
135.234.160.246
203.26.79.13
135.233.95.80
92.223.78.30
172.66.2.5
52.110.12.16
52.110.12.47
52.148.114.188
40.84.97.4
85.210.196.11
72.153.5.61
52.110.12.30
52.110.12.28

File paths

B:\}

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report