MALICIOUS — 16ccbfc3db493b19fb5fde5008f86de07cf56b4ab9cb0ef8729b0cad76c1a1da

MALICIOUS — 16ccbfc3db493b19fb5fde5008f86de07cf56b4ab9cb0ef8729b0cad76c1a1da is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the C83B492E family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 16ccbfc3db493b19fb5fde5008f86de07cf56b4ab9cb0ef8729b0cad76c1a1da
SHA-1: c70e52c9e94a57ad4fc6b3cae56a834b9345ee76
MD5: fd8ae2330eb261f5b6998a63e0278a32
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070du1LXUyEzMxwo3WQGHYPwS:Qoa1taC0iyatPHO
TLSH: T17D5A234657186B4CE2FAC4807D19265EC441E8F6A33C298E938FF19FB3CB9672811197
Submitted as: 16ccbfc3db493b19fb5fde5008f86de07cf56b4ab9cb0ef8729b0cad76c1a1da
File type: pe · Size: 1958400 bytes
Verdict: malicious (98/100) · Family: C83B492E

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 29 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

101 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\ECB.tmp - 5744f7ed02dc705e420200a2d51ff3d9286ddf4e6c891123604c8bea6cc6f725
e7061c68ea0581baffb1e7478295951affa6be0d9d0fec799c52d0c49cbb0d17 - e7061c68ea0581baffb1e7478295951affa6be0d9d0fec799c52d0c49cbb0d17

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787808973&P2=404&P3=2&P4=cRDdsCmWP9wA9Wf1BG1luUmildO0fiCojqOUl%2fYhm0E0J71oa47pPEoB79wbAPFPq8YzuEj0UGQZ0fyvYr6BXw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787809010&P2=404&P3=2&P4=ORnzAXAb9u595484LiGr0coTSm%2fgkJkJnzf2cIH1AwrTI2EPhsDqjLxK9AnHN7t0C1G1hEXUNsYoBfs5b0LDiw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

4.150.223.115
20.42.179.204
4.230.171.124
20.247.184.142
172.215.188.232
135.233.95.144
20.165.94.54
20.184.175.4
20.236.44.162
52.123.128.14
40.104.4.2
52.123.129.14
20.184.175.22
172.178.240.161
52.123.252.212
40.79.163.155
4.150.223.104
203.26.79.13
135.233.95.80
52.123.252.194
52.148.114.188
52.110.12.11
172.215.188.225
125.56.205.56
125.56.205.17

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report