MALICIOUS — 4b84ff165392c861116760f870a4f1b1dda8cbfe0d85d0e87d401632f65fb205

MALICIOUS — 4b84ff165392c861116760f870a4f1b1dda8cbfe0d85d0e87d401632f65fb205 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the C83B492E family. 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 4b84ff165392c861116760f870a4f1b1dda8cbfe0d85d0e87d401632f65fb205
SHA-1: d19fd33bbac61e1fa1bcdfd05838cc1bdabc4e51
MD5: 6dd31b632b06dc33cfcc814fffe2c1e4
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dZY3Rx42Ek5WF7IM9Uvhrqn2Et:Qoa1taC0SGRyk0F0wUIR
TLSH: T1075A23854A19670DE2F6C8846C2D167E8442E8E3A37C148A52CFF15FB7CB85B78211DB
Submitted as: 4b84ff165392c861116760f870a4f1b1dda8cbfe0d85d0e87d401632f65fb205
File type: pe · Size: 1958408 bytes
Verdict: malicious (99/100) · Family: C83B492E

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dump:Generic.Dacic.17983.C83B492E (rule Dump:Generic.Dacic.17983.C83B492E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ic (rule Backdoor.Win32.Salgorea.ic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\5DDA.tmp - 0d94c74b3c4bafd15afffd6850be1d6c1c1f7a19d36a723b4ab199e4f83bbb95
e7901545ce3d737633cc1d97e7f4c68fc0ba98ca6ff04672733c897405fcec42 - e7901545ce3d737633cc1d97e7f4c68fc0ba98ca6ff04672733c897405fcec42

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.108
52.123.252.203
4.230.171.124
172.215.188.225
172.215.188.232
104.18.33.89
74.178.240.51
20.184.175.6
52.230.59.222
74.179.77.204
20.184.175.12
4.144.132.223
57.155.104.224
52.110.12.24
52.110.12.18
72.154.7.101
52.148.114.188
52.110.12.19
52.110.12.40

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report