MALICIOUS — 4b0e39330c030daf8048d74f99f11cff7d01dac3253679a1fc7bf0b294af29ef

MALICIOUS — 4b0e39330c030daf8048d74f99f11cff7d01dac3253679a1fc7bf0b294af29ef is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 4b0e39330c030daf8048d74f99f11cff7d01dac3253679a1fc7bf0b294af29ef
SHA-1: e745da4c2d4fb851cd943ec07234a6d293b7e879
MD5: f22134df1bd0cb19aa89c6dbe123e67d
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:WFUcx88PWPOpX0SFf5RCrinJR2RC4+vfZht4J0Mqx4qFCRGcyGc:W+K88uPCHPRMiJ0C4+fsCuVyGc
TLSH: T1FF5A23D66A6A5B48E7F2C4902819767EC041F4E6937C098A428FF12E33D7467B4321DB
Submitted as: 4b0e39330c030daf8048d74f99f11cff7d01dac3253679a1fc7bf0b294af29ef
File type: pe · Size: 2089472 bytes
Verdict: malicious (99/100)

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): HEUR:Backdoor.Win32.Generic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.110085 (rule Trojan.GenericKDZ.110085) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Backdoor.Win32.Generic (rule HEUR:Backdoor.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hollowing in ngen.exe (pid 1132) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

100 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\7C9D.tmp - 32da7aa8b72c80545d0e99a3babb7d86f7bc5377363f19b40c6f0024bd8af1bf
ecef596d967ca115b544b88e6cea8742d9a84f324ffe09567bc91d2b92888526 - ecef596d967ca115b544b88e6cea8742d9a84f324ffe09567bc91d2b92888526

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.109
52.123.252.235
4.230.171.124
52.253.84.76
4.247.188.224
20.165.94.63
135.232.92.97
4.150.223.105
52.168.117.169
20.42.73.26
52.110.12.45
104.18.33.89
52.110.12.50
57.154.63.210
52.148.114.188
72.154.7.103
52.110.12.46
52.110.12.21

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report