MALICIOUS — 0bf2ac2842ec7980874cf3780b8e86bd1d34db609d94e33d62c6f3bb9eed57a1

MALICIOUS — 0bf2ac2842ec7980874cf3780b8e86bd1d34db609d94e33d62c6f3bb9eed57a1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the C83B492E family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 0bf2ac2842ec7980874cf3780b8e86bd1d34db609d94e33d62c6f3bb9eed57a1
SHA-1: 52ca14e3c5aaddc65788b3fd5caf2625deb833df
MD5: c39daa9928f19e8ef86f7c1604625c29
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dNsNpDTrsp4/NucervknZi52pyDg:Qoa1taC01Zs419eoZG2yDg
TLSH: T10E5A234A672D6B0CE2F6C4846D18065ED441E4FAA73C098A82CFF05FB3DA5A778110DB
Submitted as: 0bf2ac2842ec7980874cf3780b8e86bd1d34db609d94e33d62c6f3bb9eed57a1
File type: pe · Size: 1958400 bytes
Verdict: malicious (98/100) · Family: C83B492E

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

100 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\31E8.tmp - f2f6fcd7992e0c296bea1b8eddd18b0e1d1d749dba29e6573c63c4378c72e3d9
2b1a1ee4bf69d157de17e6da96726a87e4dae81c9ba436c6e8141625ea39de3b - 2b1a1ee4bf69d157de17e6da96726a87e4dae81c9ba436c6e8141625ea39de3b

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787886671&P2=404&P3=2&P4=eaklud%2fd8B9MjODTflKLnr6a44Z42WTIc6J%2byJAf9ejootM2Fl10SaYSBwUY9Fyz1pPtgk5gxORY467XPQeBZg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787886731&P2=404&P3=2&P4=Pb0QCcj2SPRKpSp4JvHYZQUlKjoxN0Ehylp5bpJKGddpW%2fXJHXVhsvXeCA7uc3Y1APoxbP0tJW1QL6z6JjYJEw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

51.116.253.169
4.230.171.124
20.247.184.197
85.210.196.11
74.179.77.204
4.150.223.103
74.178.240.51
20.76.201.171
40.99.134.2
52.123.129.14
52.123.128.14
20.42.73.25
172.178.240.162
203.26.79.13
74.178.232.29
92.223.78.30
52.110.12.19
52.110.12.20
52.148.114.188
162.159.142.9
40.84.97.4
72.153.5.140
52.110.12.37
52.110.12.47

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report