MALICIOUS — 304e4b30a0cdb4d103bed96ae8553ee404c0aed6af0e20c2f20cbc5c9de8a32b

MALICIOUS — 304e4b30a0cdb4d103bed96ae8553ee404c0aed6af0e20c2f20cbc5c9de8a32b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the C83B492E family. 4 of 51 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 304e4b30a0cdb4d103bed96ae8553ee404c0aed6af0e20c2f20cbc5c9de8a32b
SHA-1: 3026fd9896b96d911008a0acc0403d19b0b5ea31
MD5: cc80026e3eb18abc574583b80d5eed41
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dgevujhpvbTwbl0MWE2kxKYDDVTwK:Qoa1taC0Uvujhxbul0MWDkgYJ/
TLSH: T1F75A2395562A270DE2F3C0406C6912AEC442E4F7A3781A8B528FF15EB7CB97378111DB
Submitted as: 304e4b30a0cdb4d103bed96ae8553ee404c0aed6af0e20c2f20cbc5c9de8a32b
File type: pe · Size: 1958400 bytes
Verdict: malicious (100/100) · Family: C83B492E

Detections (4 of 51 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (C83B492E): 4a7a497915020d8685809f973c37fb4a316f927110476a22d86d8434957b7bb0 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dump:Generic.Dacic.17983.C83B492E (rule Dump:Generic.Dacic.17983.C83B492E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Bingoml.ckfs (rule Trojan.Win32.Bingoml.ckfs) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 51 external host(s) at runtime (17 HTTP) - network signal, weight 0.40, confidence 0.80
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

98 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/27540/files/4a7a497915020d8685809f973c37fb4a316f927110476a22d86d8434957b7bb0 - 4a7a497915020d8685809f973c37fb4a316f927110476a22d86d8434957b7bb0
b58ba90d225b87a709da1f2251b1a40a856f3387c799de2874848506b62cc99c - b58ba90d225b87a709da1f2251b1a40a856f3387c799de2874848506b62cc99c

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

4.150.223.97
4.230.171.124
57.155.101.212
20.247.185.124
74.178.240.61
40.79.141.153
20.112.250.133
135.234.160.244
4.247.188.233
20.231.239.246
4.150.223.106
135.233.95.135
135.233.95.144
20.42.179.204
52.123.252.243
20.184.175.16
74.178.76.128
52.123.252.241
172.215.188.225
162.159.36.2
203.26.79.13
52.123.129.14
20.42.65.94
52.123.128.14
4.150.223.109

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report