MALICIOUS — 5fcc5f0e42a06e078a9f3ee228037f2f44dc452aa4fbe3a6603b0893e0e5cfce

MALICIOUS — 5fcc5f0e42a06e078a9f3ee228037f2f44dc452aa4fbe3a6603b0893e0e5cfce is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the C83B492E family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 5fcc5f0e42a06e078a9f3ee228037f2f44dc452aa4fbe3a6603b0893e0e5cfce
SHA-1: 2c5cce7298f13591058b96163ac87d350ae6f29a
MD5: 50cf6e1f47a930ac9826384ad66a1acc
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dD6VRoEjDf1mEtAjm6Pf5Om6ogs:Qoa1taC0b4cUPxOmJF
TLSH: T11B5A23861A096B0CF3F6C4822D6D166DD042D4AB973814CF828FF11EB7D7D6B682119B
Submitted as: 5fcc5f0e42a06e078a9f3ee228037f2f44dc452aa4fbe3a6603b0893e0e5cfce
File type: pe · Size: 1958400 bytes
Verdict: malicious (98/100) · Family: C83B492E

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\3FD3.tmp - 1ea68acc28b954702170e41246f97278ec4e6b15ca8aeac2c734293d8287c73b
917c5780e63bc16f92790c9ca39da73c4f710cd1c93aadf83d59649445a4993c - 917c5780e63bc16f92790c9ca39da73c4f710cd1c93aadf83d59649445a4993c

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787808673&P2=404&P3=2&P4=A6BLRYgDpgtLWY056NyTOYBmY5FGmlOY1pWqsXhHW7J8BUVuH5oEP5hFzr2LyYavyK5NBvKtv0tJzC%2bzx1jZ3g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787808688&P2=404&P3=2&P4=bw4xhijIBH3APNuULjHu2gYNbwBi5F3Okv0t5FGGpO%2fqKBAIOL5srCf3qZV7Lz4tFdEUGlxY%2bUIF%2f2UZ61zefQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

52.168.117.174
52.123.252.223
40.84.85.40
20.247.184.142
4.230.171.124
20.165.94.63
74.178.240.51
4.207.44.72
52.123.128.14
20.231.239.246
52.168.112.67
172.178.240.163
135.232.92.34
172.66.2.5
203.26.79.13
52.148.114.188
125.56.205.24
125.56.205.51
52.168.117.175
20.184.175.10
72.154.7.109
52.110.12.51
52.110.12.26

File paths

x:\n!

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report