MALICIOUS — 1850b8dec038cc678e0ba5897ff2616e0f925286c38e555115068b62628b5124

MALICIOUS — 1850b8dec038cc678e0ba5897ff2616e0f925286c38e555115068b62628b5124 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the C83B492E family. 4 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 1850b8dec038cc678e0ba5897ff2616e0f925286c38e555115068b62628b5124
SHA-1: 87114e0fe7ea4834896571097aa2f05ac40e4782
MD5: c4f8110dd412043edb63da840caab790
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dTQ5MFpRg3v4wRcYY3KupSL7vXraYnGjFgaTo:Qoa1taC070dTQe75wWCL7/rkFZWfR9
TLSH: T1085A238656095B0CE6F6C4843C6C26BEC402F4E7A378168B428FF16EB7CB9677811197
Submitted as: 1850b8dec038cc678e0ba5897ff2616e0f925286c38e555115068b62628b5124
File type: pe · Size: 1958400 bytes
Verdict: malicious (98/100) · Family: C83B492E

Detections (4 of 52 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 42 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

98 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/26841/files/da0dc1ad47885f1771c00e852bd9e031923b346c706d266f5dcb35a7377ff61f - da0dc1ad47885f1771c00e852bd9e031923b346c706d266f5dcb35a7377ff61f
e5bb676e74f4a16debbf647e503bafe1c1dd23ab0fc49ba0f01460eef9c5cf28 - e5bb676e74f4a16debbf647e503bafe1c1dd23ab0fc49ba0f01460eef9c5cf28

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e?P1=1786971443&P2=404&P3=2&P4=YBULTbwrS4PPxMUH13F7opRpiPnLq8FzzMhVbV7Tc8%2fFshmHK49ZGifFX8q9K%2fi7tzehi5romW25Xk5S%2bQujow%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/1d8d0488-0a3b-440b-b2a9-36df2b9d4ebd/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/1d8d0488-0a3b-440b-b2a9-36df2b9d4ebd?P1=1786971543&P2=404&P3=2&P4=LcVOvF9BptIzCBXmOjY8wbVw7RB6lh0wJRyXklufZ8RILIJAVKnarWynm21jPztINeBx%2bTdCRUUhG2%2bWHTrNbQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

52.182.143.212
52.253.84.76
4.230.171.124
85.210.193.152
57.155.104.224
135.232.92.137
104.208.16.94
74.179.77.164
92.223.78.30
20.76.201.171
40.99.133.242
52.123.129.14
48.211.4.16
172.178.240.162
203.26.79.13
52.148.114.188
20.165.94.46
52.110.12.3
52.110.12.54
149.154.167.99
149.154.165.137
4.243.160.21
135.233.95.80
52.110.12.49
52.110.12.44

File paths

W:\}A

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report